If you see clients privately, even a handful of evenings a week from a rented room, the short answer is almost certainly yes. You need to pay the Information Commissioner’s Office its data protection fee. For a practice your size it costs £52 a year, or £47 by direct debit, and it takes about fifteen minutes.
The longer answer is worth knowing too, because paying the fee is the easy part of data protection for a counsellor, and it is easy to mistake it for the whole thing.
“Registration” is really a fee
Strictly, nobody has “registered with the ICO” since May 2018. What replaced registration is the data protection fee, set by the Data Protection (Charges and Information) Regulations 2018. Every organisation that handles personal information has to pay it unless it is exempt, and the ICO is clear that this includes sole traders.
Once you pay, you appear on the ICO’s public register of fee payers, which is why everyone, including the ICO itself, still calls it registering. The practical difference is small: it is annual, it is a payment rather than an application, and nobody approves or inspects anything when you make it.
Why the exemptions don’t cover a counselling practice
There are exemptions, and a quick skim of them can make it look as though a small practice slips through. It does not. The ones people reach for:
- “I only use it for my accounts.” The accounts and records exemption covers keeping accounts and records of sales and purchases, and deciding whether to take someone on as a customer. It does not cover session notes, an intake form, or a record that someone is having therapy with you, which is the main reason you hold anything at all.
- “My notes are on paper.” The exemption here is for information not processed wholly or partly by automated means. A client’s name in your phone, an email arranging a session, an entry in an online calendar or a booking system: each of those is automated processing. Hardly any practice genuinely runs on paper alone.
- “I’m too small to count.” Size decides which tier you pay, not whether you pay. The smallest tier exists precisely for practices like yours.
The underlying reason is that what you hold is health information. That a named person is in counselling, let alone why, is special category data under UK GDPR, and none of the exemptions covers the reason you hold it: caring for the people you see.
If you want to be certain, the ICO has a short self-assessment on its website that walks through the exemptions one question at a time. BACP’s own guidance for members points to the same tool.
What it costs
There are three tiers, and a solo practice sits in the first one:
| Tier | Who | Fee |
|---|---|---|
| 1 — Micro | Turnover up to £632,000, or no more than 10 staff | £52 (£47 by direct debit) |
| 2 — Small and medium | Turnover up to £36 million, or no more than 250 staff | £78 |
| 3 — Large | Everyone else | £3,763 |
A few practical points:
- It is annual. Pay by direct debit. It saves £5, and more usefully it means you cannot forget to renew.
- Register in the name you trade under, so a client or a referrer who looks you up on the register finds you.
- Not paying is a penalty in its own right, separate from any breach. For a practice your size the fixed penalty is £400, nearly eight times the fee, and the ICO does pursue non-payers.
Paying the fee is not the same as complying
This is the part the question usually hides. The fee is a tax on handling personal information, not a certificate. The ICO does not check anything when you pay it, and being on the register says nothing about how you look after what you hold.
What actually protects your clients, and you, is a short list:
- A privacy notice. A plain page telling clients what you hold, why, how long you keep it and who else sees it. Link it from wherever people book or first contact you.
- The right lawful basis. Your basis for keeping records is usually not the client’s consent. Consent to therapy and your legal basis for processing health information are different things, and one tickbox that tries to do both muddles both. UK GDPR asks for two things here. The first is an ordinary lawful basis for anything you hold about a client, which for most private practices is the contract to provide counselling. The second is an extra condition for the health information itself, and most counsellors providing care rely on the health and social care condition. The ICO’s guidance on lawful basis and on special category data explains the options.
- A retention period you can state. Your insurer or professional body may recommend one. Pick it, write it in your privacy notice, and then actually delete on schedule.
- Security that fits the data. A passcode on the phone that holds client names, encrypted devices, and no session notes in a personal email account.
- Contracts with the services that hold your data. Your booking system, your email provider and wherever your notes live are all processing client information on your behalf. UK GDPR expects a written contract with each of them (a data processing agreement), and you are the one responsible for having it.
- Knowing what to do when something goes wrong. A personal data breach has to be reported to the ICO within 72 hours of your becoming aware of it, unless it is unlikely to put anyone at risk. That bar is lower than it sounds: a lost phone with client names on it, unencrypted, will usually meet it. A client asking for a copy of their records must usually get it within a month.
None of that is a weekend’s work, but most of it is a one-off, and all of it is what a complaint to the ICO would actually ask about.
How to pay it
- Go to the ICO’s data protection fee page.
- Answer the tier questions — turnover and staff numbers.
- Enter your trading name and contact details, which is what appears on the public register.
- Choose direct debit.
You get a registration reference once it is paid. Note the renewal date, because the direct debit will take it again a year from now.
Where Praxbook fits
Praxbook is a booking system for practitioners who work on their own, and it is one of the services on that list above: if you use it, it holds your clients’ names, appointments and consent form answers on your behalf.
What we can say plainly: client records are stored in a database in the UK and used for nothing but running your practice. A few services handle parts of it for us, such as delivering emails and texts, and our privacy policy names each one and where it works. Nobody signs in with a password, clients included; every sign-in is a one-time code sent by email. And each appointment keeps its own history, so you can see what changed and when.
What we cannot say yet: we do not publish a data processing agreement. That is on our list, and until it exists we will not describe Praxbook as “GDPR compliant”, because your compliance depends on that contract and it would not be honest to imply you have it. Ask any booking system you are considering for theirs. It is a fair question, and the answer tells you a lot.
Try Praxbook free for 30 days, or share this post with a colleague who might find it useful.