Handling Client Food Diaries Under GDPR

A food diary is health data, which makes it special category data under UK GDPR. And a closed statutory list in the Data Protection Act 2018 means a nutritionist cannot rely on the same lawful basis a dietitian can, which pushes most nutritionists onto explicit consent with all the consequences that carries.

That second point is buried in a definition nobody reads, and it changes the paperwork for an entire profession.

Is a food diary really health data?

Yes, and the threshold is lower than people expect.

The ICO treats health data as any personal data revealing information about someone's state of health. It does not have to be a diagnosis. A dietary questionnaire capturing allergies or intolerances reveals health information, and so does a diary that records symptoms alongside meals, or notes medication timing, or shows a restrictive pattern.

Since virtually every food diary used clinically does at least one of those things, the practical answer is to treat them as special category data from the start.

That triggers UK GDPR Article 9, which prohibits processing special category data unless you meet one of the specific conditions in Article 9(2), plus a lawful basis under Article 6.

Which Article 9 condition applies?

This is where dietitians and nutritionists part company.

Article 9(2)(h) permits processing for the purposes of health or social care. In the UK it is paired with a condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

The catch is in that paragraph. The processing must be carried out by or under the responsibility of a health professional, or by another person who owes an equivalent duty of confidentiality.

And "health professional" is not a common-sense term here. It is defined by section 204 of the Data Protection Act 2018, which sets out a closed list. Paragraph (g) covers professions regulated under the Health and Social Work Professions Order 2001.

So a dietitian processing a food diary uses the health and social care route straightforwardly. A nutritionist cannot, at least not on the same footing.

What does that leave?

Two possibilities, and one is much more commonly relied on than the other.

The duty of confidentiality route. Paragraph 2 also covers a person who owes a duty of confidentiality equivalent to that of a health professional. A nutritionist bound by a professional code with confidentiality obligations may be able to rely on this. It is arguable rather than obvious, and it is not a position to adopt without advice.

Explicit consent, under Article 9(2)(a). The route most nutritionists end up on in practice.

Why is explicit consent harder than it sounds?

Because consent under UK GDPR has to meet a high bar and, crucially, it can be withdrawn.

It must be freely given. Consent bundled into the act of booking, where refusing means no service, is not freely given.

It must be specific and informed. A general privacy policy acceptance is not explicit consent to process health data.

It must be as easy to withdraw as to give. And when it is withdrawn, you must stop processing on that basis.

That last point is the practical problem. A client who withdraws consent while you still hold their records leaves you needing another basis for continuing to hold them, typically a legal obligation or the establishment or defence of legal claims. That is workable, but it needs thinking through in advance rather than improvised at the moment somebody asks.

The dietitian, relying on the health and social care condition, does not face the same cliff edge.

What should a nutritionist actually do?

Six things.

1. Take advice on which condition you rely on. This is the decision everything else follows from, and it is worth an hour of a specialist's time
2. Write it down in a record of processing. You need to be able to say which Article 9 condition applies and why
3. Collect explicit consent properly if that is your route: separate from your terms, specific about health data, and recorded with a date
4. Have a written answer for withdrawal. What you stop doing, what you keep, and on what basis
5. Say it plainly in your privacy notice. What you collect, why, how long you keep it, and who else sees it
6. Set a retention period and apply it. Food diaries accumulate quickly and there is rarely a reason to hold them indefinitely

Practical handling

Beyond the lawful basis, the ordinary obligations apply and they are where most breaches actually happen.

Do not collect diaries by email attachment if you can avoid it. Email is the least controlled channel most practices use, and a food diary sitting in a mailbox for years is a real exposure.

Do not use consumer file-sharing for client records without checking where the data sits and who the processor is.

Do keep them with the client record rather than in a parallel system, so a subject access request or a deletion request can actually be answered.

That last point is the practical argument for holding diaries inside your practice system rather than around it. Atlacare stores form submissions and uploaded files against the patient record with access controls and an audit trail, and applies a retention rule based on last contact, which turns deletion from something you must remember into something that happens.

The wider picture

This is one of four places where being outside statutory regulation has a concrete cost for nutritionists, alongside VAT, advertising claims and insurance. Our guide to whether you can call yourself a nutritionist covers all four.

None of them is a reason not to practise. They are reasons to know which rules apply to you specifically, rather than borrowing a dietitian's answers.

This is general information about data protection obligations, not legal advice. Which Article 9 condition applies to your practice depends on your professional position and how you work. Take advice before settling your lawful basis, and confirm the current ICO guidance.

Sources: Data Protection Act 2018, section 204 · Data Protection Act 2018, Schedule 1, health or social care purposes · ICO, special category data

Related: Can I call myself a nutritionist without a degree? · Can nutritionists order blood tests? · UK GDPR for practitioners