UK GDPR for Physiotherapists: Six Things You Must Do

Health data is not ordinary personal data. Under UK GDPR it falls under Article 9 as special category data, which means stricter rules apply to how you collect, store, use, and delete it.

If you run a private physiotherapy practice in England, Scotland, or Wales, this applies to you. You are a data controller — and that word does more work than most practitioners realise.

Who is responsible: you or your software?

Under UK GDPR you are the controller of your patients' clinical records. You decide what is collected, why, and how long it is kept. Your practice management software, your cloud storage, and your email provider are processors: they handle that data on your instructions.

The distinction matters because the legal duty sits with you and cannot be outsourced. If a provider tells you their software makes your practice GDPR compliant, that is not a thing software can do. The ICO will come to you, not to your vendor.

What a processor can do is make the duty possible to meet — or quietly impossible. You cannot write an accurate privacy notice if you do not know who your provider shares data with. You cannot honour a retention schedule if the system has no way to enforce one. You cannot answer a subject access request in a month if getting the records out takes three weeks and an email to support. So the six obligations below are yours, but four of them depend on what your tools give you.

The six things you must do

1. Register with the ICO

Most private practitioners must pay the ICO's annual data protection fee (currently £40 for sole traders and small organisations). If you are not sure whether you are caught, the ICO has a free registration self-assessment that takes a few minutes. Failure to register is a civil monetary penalty.

2. Write a privacy notice

Patients must be told what data you collect, why, how long you keep it, and who you share it with — before their first appointment. A one-page PDF sent with their intake form is sufficient. Include your name and contact details, the lawful basis for processing, and how patients can exercise their rights. The ICO's small organisations hub has templates if you are starting from a blank page.

Note the "who you share it with" part. That means naming the categories of processor behind your practice — your software, your payment provider, your appointment reminders. You need your provider's sub-processor list in front of you before you can finish writing this, which is a reasonable thing to ask for before you sign up rather than after.

3. Establish your lawful basis

For clinical records, your lawful basis under Article 6 is usually legitimate interests or contract. But because health data is Article 9 special category, you also need a Schedule 1 condition under the Data Protection Act 2018. For healthcare practitioners, the relevant condition is health or social care purposes under paragraph 2, which expressly covers the provision of health care or treatment.

You do not need explicit consent for clinical records, but you do need it for anything beyond direct care, such as marketing emails.

4. Keep a Record of Processing Activities (ROPA)

A ROPA is a written record of what personal data you hold, why, where it lives, and how long you keep it. For a sole-trader physio, a one-page spreadsheet is enough. You do not submit it to the ICO, but you must be able to produce it if asked — the ICO sets out what a record should contain.

Half of a ROPA is really a description of your software: which systems hold what, in which country, under which contract. If your provider publishes that information, most of the document writes itself. If they don't, you are guessing on a form you may have to defend.

5. Set retention periods and stick to them

You cannot keep data indefinitely. The NHS Records Management Code of Practice is the reference standard private physios should follow. Its retention schedule sits in Appendix II, and the periods listed are minimums, not targets.

• England and Wales: eight years from last contact for adult records.
• Scotland: six years from last contact for adult records.
• Children and young people: retain until their 25th birthday, or eight years from last contact, whichever is later.

See our full retention guide for the complete table.

The hard part is not knowing the number — it is doing something about it in 2034. Nobody manually deletes a discharged patient's file eight years later, which is why paper files and shared drives quietly turn into indefinite retention. This is one of the few compliance duties that a system can genuinely carry for you, provided it tracks last-contact dates and applies a rule to them.

6. Know how to handle a data breach

If personal data is lost, accessed by the wrong person, or sent to the wrong recipient, you may have 72 hours to notify the ICO. Not every breach requires notification, but you must assess each incident and document it whether or not you report — the ICO's guide to personal data breaches is clear that the documentation duty applies either way. Keep a breach log, even if it stays empty.

What patients can ask for

Subject Access Request. Patients can request a copy of everything you hold on them. You have one month to respond, at no charge.

Correction. If a patient disputes a factual entry, note the dispute in the record rather than altering a signed clinical note.

Erasure. Patients can ask to be forgotten, but this right is not absolute. Your legal obligation to retain clinical records for complaints, litigation, and regulatory purposes overrides a deletion request in most cases — the ICO's own guidance uses a healthcare example where records are kept for the defence of legal claims. Document your decision if you decline.

Portability. Patients can ask for their data in a machine-readable format. A PDF export usually satisfies this in practice.

As controller, these requests come to you, not to your software provider. What you should expect from the provider is help executing them — a way to pull a complete patient record, and a deletion process that understands the difference between "erase this" and "we are legally required to keep this."

10-item compliance checklist

• Registered with the ICO and fee paid
• Privacy notice written and sent to new patients before their first appointment
• Lawful basis identified for each type of processing
• Schedule 1 DPA 2018 condition documented for health data
• Record of Processing Activities (ROPA) written and up to date
• Retention periods set for all record types
• Separate consent collected for marketing (if you send it)
• Data breach log created
• Procedure in place for handling subject access requests, erasure, and correction
• Data processing agreement in place with every provider that touches patient data, with hosting region confirmed

Where the data actually lives

Most of the checklist above turns into questions about infrastructure, and most providers answer them with adjectives. Here is what the answer looks like when it is specific, using Atlacare as the worked example — you should be able to get the same level of detail from anyone you're considering.

Hosting region

Clinical records, appointments, and documents are stored in the EU. The application and its Postgres database run in Railway's EU West region; files and documents sit in Cloudflare R2 in the EU. There is no replica outside the UK or EU, so there is no international transfer to explain for the clinical record itself.

The sub-processor chain

Every provider uses other providers. The question is whether they'll tell you which, because your privacy notice and ROPA depend on the answer.

One entry on that list is outside the EU. It is the tool that emails clinic owners about their own account, it is covered by Standard Contractual Clauses, and no patient data reaches it. That is the kind of sentence you want from a provider — a specific exception with a specific safeguard, rather than a blanket claim that turns out to have exceptions in it.

Separating clinical data from account data

The controller/processor line is not the same for every piece of data, and it is worth structuring the system that way from the start. For patient health records, the practice is the controller and Atlacare is the processor. For login credentials, session security, and technical logs, Atlacare is the controller — those exist to keep the platform secure, not to deliver care. Patients using the portal get their own privacy notice covering that narrow slice, separate from the clinical privacy notice you give them as their clinician.

Deletion that understands the law

An erasure request against a clinical record is rarely a simple delete, because your retention duty usually outranks the request. Atlacare's deletion flow sorts data into three outcomes rather than one:

• Deletable — data with no retention basis, removed outright.
• Anonymisable — data that is useful in aggregate but does not need to identify anyone, stripped of identifiers.
• Legally retained — clinical records inside their statutory retention window, kept and flagged, with the reason recorded.

That third category is the one that matters when you have to justify declining a deletion request in writing.

Leaving

Your retention obligation outlives your subscription, which makes exit terms a compliance question rather than a commercial one. Atlacare's terms give a 90-day export window after termination, an explicit export-confirmation step before anything is deleted, and a further 30-day retrieval period as a safety net. Exports are restricted to the practice owner rather than any logged-in user, because a full clinical export is exactly the kind of action that shouldn't be available to everyone with a password.

What isn't stored

Video consultations are not recorded. Patient data is never sent to marketing tools. Patient data is not used to train AI models.

Questions to ask any provider

Before you sign up to any practice management system, ask:

1. Where is patient data physically hosted? Ask for a region, not a reassurance.
2. Who are your sub-processors, and is the list public? A provider who won't name them cannot help you write your privacy notice.
3. Is there a data processing agreement, and can I read it before I sign?
4. If anything sits outside the UK or EU, which transfer mechanism covers it — the ICO's International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision?
5. How do I export everything, and what happens to my records if I cancel?

"We're GDPR compliant" is not an answer to any of these. It is not a hosting region, it is not a sub-processor list, and it is not a transfer mechanism.

Atlacare is built for UK and EU practices, so these answers are published rather than available on request: the sub-processor list and the hosting regions above are on the site before you create an account.

Related: How Long to Keep Physiotherapy Patient Records | Do I Need CQC Registration as a Private Physiotherapist?

This article is general information, not legal advice. If you are unsure how these obligations apply to your practice, speak to a data protection adviser.