GDPR Data Processing Agreement
Bringing in help? Get the paperwork right first.
If a virtual assistant manages your inbox, a bookkeeper sees your invoices or a transcriber types up your letters, they’re handling your clients’ personal information on your behalf. UK GDPR says you must have a written contract with them, with specific terms, before they start.
For therapists, where that information often includes health details, it matters even more. This agreement gives you exactly that, written for therapy practices and ready to fill in.
What’s included
- Data Processing Agreement (Word), covering every term Article 28 of the UK GDPR requires:
- processing only on your instructions
- confidentiality for anyone who sees the data
- minimum security measures, including two-step verification, a password manager and no client details over WhatsApp
- rules for AI tools: only ones you approve by name, and never used to train AI models
- approved apps and services (sub-processors), with where each stores data
- help with data rights requests, passed to you within 2 working days
- breach notice within 24 hours, so you can meet the regulator’s 72-hour deadline
- transfers outside the UK, under the new “not materially lower” test
- returning or deleting data when the work ends
- Schedule 1, where all the details go, with therapy examples you can keep or delete.
- Guidance & Notes (PDF): when you need this agreement, when a big provider’s own terms are enough, who isn’t a processor at all (your supervisor, GP or accountant), and how to fill it in.
[The guide is a digital download only that can be printed out as required]
Up to date for 2026
- Written for UK law, with no leftover EU references.
- Updated for the Data (Use and Access) Act 2025, including the new test for transfers abroad and the regulator’s new name.
- Security advice in line with current NCSC guidance.
Simple to use
Anything in blue square brackets needs your details. Most of it goes in Schedule 1, so the main agreement rarely needs changing. Talk it through with your supplier, sign it before they start, and keep a copy with your records.
Who it’s for
Therapists, counsellors and wellbeing practitioners in the UK who use a virtual assistant, bookkeeper, transcriber, freelance admin, IT support person or a web designer who can see contact form messages.
Instant download. A zip file with the agreement in Word and the Guidance & Notes as a PDF.
Also included in the Pocket Site Data Protection Handbook.
This template and guidance are not legal advice. If your situation is complex, take professional advice.
Sophie Wood
Pocket Site has been created jointly by Sophie Wood, a website consultant with Sarah D Rees, a CBT therapist.
Pocket Site Creators
Sophie has been working with IT and websites for 20 years and enjoys nothing more than simplifying the internet and helping therapists use it as a business tool like any other.
Sarah has been in private practice for over 5 years and wanted to help other therapists build their own sustainable business.
We've brought our experience and skills together, with combined feedback from other therapists in Pocket Site products and services.
Sarah Rees
