GDPR in Belgium: a guide for psychologists and therapists

GDPR compliance for a psychologist or therapist in Belgium is the set of rules that govern the notes and records they keep on their patients. This information is almost always health data. The GDPR puts it among the special categories of data (Article 9), with stricter rules.

This guide is written first for clinical psychologists. It also explains what changes for therapists who are not recognised as healthcare professionals. Consent to AI note-taking is a separate topic, covered in our French-language article on AI note-taking in Belgium. For a general overview from the French side, see GDPR for private practitioners in France.

Which laws apply to you

The GDPR applies to anyone who processes personal data. That includes a clinical psychologist, a psychotherapist, a therapist or a coach. In Belgium, it is supplemented by the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This law adds three measures for health data (Article 9). You designate the categories of people who have access to the data, with a description of their role. You keep this list available to the Data Protection Authority (APD). And you make sure these people are bound by confidentiality.

Clinical psychologists have been recognised as healthcare professionals since 2016. The Belgian Psychologists' Commission points out that two other laws therefore apply to them. The Law of 22 April 2019 on the quality of healthcare practice sets the content of the patient file and how long it is kept. The Law of 22 August 2002 on patient rights sets the rules on access and copies.

If you are a therapist but not a healthcare professional

These two laws cover the healthcare professionals of the Law of 10 May 2015. They also cover practitioners of a non-conventional practice within the meaning of the Law of 29 April 1999. Depending on your practice, you could therefore fall within them. We advise checking your situation with your professional body or a lawyer. The GDPR, however, applies in full. What you write down about a person in distress is usually still health data.

The Psychologists' Commission advises non-clinical psychologists to follow the principles of these two laws. We advise other therapists to do the same.

You are the controller

You decide why and how your patients' data is processed. That makes you the controller, even if you practise alone. You must be able to show that you comply with the GDPR.

If you are a health professional bound by professional secrecy, you do not need the patient's consent in the GDPR sense to provide care. Article 9 allows this processing for the provision of care. Otherwise, the legal basis needs checking. Either way, you tell the patient what you do with their data.

The record of processing activities

Article 30 of the GDPR provides an exemption for organisations with fewer than 250 employees. It does not apply if the processing is not occasional or if it covers health data. That is your case. So the record applies to you, even in solo practice.

The European Commission proposed relaxing this exemption in 2025. To our knowledge, the text has not yet been adopted.

The record has no required format. A spreadsheet is enough. For each processing activity, it states:

• your contact details;
• the purpose (for example patient follow-up, invoicing, booking appointments);
• the categories of people and of data;
• the recipients, including your processors;
• any transfers outside the European Union;
• the retention periods;
• a general description of your security measures.

We advise reviewing the record each time you adopt a new tool.

Your software or AI note-taking tool is a processor

A provider that processes data for your practice is a processor. That covers your patient records software, your hosting provider, your online calendar and your AI note-taking tool.

Article 28 of the GDPR requires you to use only processors that provide sufficient guarantees. The processing must be governed by a contract. The contract sets out the subject matter, duration, nature and purpose of the processing, the type of data and your rights. The processor only processes data on your documented instructions. The APD points out that this contract is always mandatory.

Before adopting a tool, we advise checking these points:

• the data processing agreement exists and you can read it;
• you know where the data is hosted and where the AI processes it;
• you know whether the vendor uses the data to train its models;
• the data is encrypted;
• you can export a patient's full file.

Hosting and transfers outside the European Union

Within the European Union, data moves freely. Outside the Union, the GDPR only allows a transfer within a specific framework (Articles 44 and following). You need an adequacy decision from the European Commission, or appropriate safeguards such as standard data protection clauses.

The point to watch is often the AI. A tool can host your files in Europe and send the transcript to a service located elsewhere. Ask the question in writing. HDS certification is French. It is not required in Belgium, but it is a useful benchmark. We explain it in our guide to HDS-certified hosting.

A concrete example. Delta, the clinical assistant for mental health and allied health professionals, hosts data in France with an HDS-certified provider, and AI processing takes place in France. The patient's name and identifying information are pseudonymised before the AI step. No audio file is kept, data is never used to train a model, and it is encrypted in transit and at rest. The tool is described in our reference page on Delta.

How long to keep the patient file

Article 35 of the quality law sets the rule. The healthcare professional keeps the patient file for at least 30 years and at most 50 years from the last contact with the patient. The Psychologists' Commission confirms that this applies to clinical psychologists.

If you close your practice for good, the Commission advises passing the files to a fellow clinical psychologist, with the patient's agreement. We advise naming that colleague in advance, in case you have to stop unexpectedly.

For therapists who are not covered by the quality law, no specific text sets a period. The GDPR requires that data is not kept longer than necessary. Set a period, justify it and enter it in your record.

Patient rights

Access and copies

The patient rights law (Article 9) gives the patient the right to consult their file and to obtain a copy. You must respond as soon as possible and within 15 days at the latest. Data concerning third parties is excluded. The first copy is free. Further copies may carry reasonable and justified fees.

The former exception for the practitioner's "personal notes" was removed by a reform in 2024. According to the Psychologists' Commission, the patient can now consult all your personal notes, whatever their date. We therefore advise writing every note as if the patient might read it.

The GDPR also provides a right of access and a right to a copy (Article 15), with a one-month deadline. If the patient rights law applies to you, the shorter 15-day deadline is the one that counts.

Rectification and erasure

The patient can ask for inaccurate data to be corrected. They can also ask for their data to be erased. This right has limits. Article 17 of the GDPR does not apply where processing is needed to comply with a legal obligation. For clinical psychologists, the Psychologists' Commission considers that the right to be forgotten cannot apply to the patient file.

Security and data breaches

The GDPR requires security measures suited to the risk. Clinical notes are highly sensitive. We advise a separate password for each tool, two-factor authentication, an encrypted and locked computer, and no patient files on an unprotected USB stick.

In the event of a data breach (loss, theft, unauthorised access), Article 33 requires you to notify the APD without undue delay and, where possible, within 72 hours of becoming aware of it. This is not needed if the breach is unlikely to result in a risk to people. Notification goes through the APD portal. Notifications sent by email are not processed.

If the risk is high, you must also inform the patients concerned (Article 34). And you document every breach, including those you do not notify (Article 33).

Do you need a DPO

A data protection officer (DPO) is mandatory when the core activities consist of large-scale processing of health data (Article 37). The APD gives two examples. Patient data in a hospital is large scale. Patient data held by an individual doctor is not. Recital 91 of the GDPR says the same for a healthcare professional working individually.

A psychologist or therapist in solo practice therefore generally does not need a DPO.

Data protection impact assessment (DPIA)

A DPIA is mandatory when processing is likely to result in a high risk, in particular when it involves large-scale processing of health data (Article 35). According to Recital 91, it should not be mandatory for a healthcare professional who processes their own patients' data individually.

The APD has published a list of eight types of processing that require a DPIA (decision of 16 January 2019). One item may concern group practices or networks. It is the systematic exchange of health data between several controllers. The list is not exhaustive.

If you adopt an AI tool, we advise writing a one-page note on the risks and the measures taken, even if a DPIA is not mandatory for you.

Where to start

• Draw up your record, one processing activity per line.
• List your providers and collect each data processing agreement.
• Write down who has access to the files, as Belgian law requires.
• Set your retention periods.
• Prepare an information notice for your patients.
• Write a short breach procedure, with the link to the APD portal.

For the letters, certificates and reports that feed into the file, see our clinical document templates by profession. And to see what the tool does, read our reference page on Delta.

Sources

• GDPR, Regulation (EU) 2016/679, EUR-Lex
• Belgian quality law of 22 April 2019, consolidated text, Justel (French)
• Belgian patient rights law of 22 August 2002, consolidated text, Justel (French)
• Psychologists' Commission, The patient file (French)
• APD, When a DPO is mandatory (French)