Process notes vs case notes in counselling: what to keep and what clients can see

Process notes and clinical records are two kinds of writing that counsellors keep about the same sessions, for different readers. The clinical record exists to support the client's care and to show what was done. Process notes, as the term is commonly used in UK counselling, exist to help the counsellor reflect, learn and prepare for supervision.

The question counsellors keep asking is simple. Can a client ask to see process notes? This guide sets out what UK data protection law and BACP materials say, and how to write and store each kind of note.

This guide relies on the ICO, the legislation and BACP documents that are publicly available. BACP members can also consult Good Practice in Action 071, "Ownership and storage of client notes and records", which BACP makes available to members.

Process notes and clinical records: two working definitions

There is no single legal definition of either term. Here is how they are often used in practice.

The clinical record

The clinical record (also called case notes or session notes) is the factual account of the work. It usually holds the contract and consent, contact details, dates of sessions, a brief summary of each session, risk information and the actions taken, correspondence, and the ending. It is written to be understood by someone else, such as a colleague covering your caseload, a supervisor, or the client.

The BACP Ethical Framework for the Counselling Professions 2026 asks members to keep records that are "factual, adequate and relevant for the type of service offered". They must be "stored securely" and comply with the data protection requirements of the country where the record is stored (clause 3.2). In a March 2026 blog its Client Ethics Manager wrote: "We also don't stipulate what notes should look like."

Process notes

Process notes are often used to mean a fuller, more personal account of a session. They tend to include:

• what the client said, sometimes close to word for word
• the counsellor's own feelings, reactions and associations during the session
• hunches, questions and tentative links that are not yet worked through
• material for supervision, personal therapy or a training assignment

Training courses may ask students to write process notes or process reports as part of their assessment. The exact requirements vary by course, so check your course handbook rather than relying on a general definition.

The key difference is purpose. The record serves the client's care. Process notes serve the counsellor's learning.

What the law says: the label does not decide access

UK GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4). It does not create a category of "private" or "process" notes. Data concerning health is defined as personal data "related to the physical or mental health of a natural person". Notes about what a client brings to counselling will usually meet that definition.

The ICO's guide to subject access says individuals have the right to "a copy of their personal information" and to other supplementary information. The test is whether the information is the requester's personal data, not what you call the document it sits in.

BACP's own framework points the same way. Clause 3.2(c) of the 2026 framework says records should "include all communications, notes and other information held relating to clients or service users working with us". And BACP's public resource GPiA 065, on confidentiality and record keeping (updated January 2024), states that "even a practitioner's personal reflections about a client that are scribbled down on a scrap of paper could be regarded as a record". It adds that "notes made in preparation for, during and after supervision, where a client is discussed, are also records."

So the safe working assumption is this. If process notes identify the client and you keep them, treat them as part of what the client can ask for.

What about handwritten notes in a notebook?

The ICO explains that UK GDPR covers information processed electronically, and paper information held or intended to be held in a "filing system". Article 4 of UK GDPR defines a filing system as "any structured set of personal data which are accessible according to specific criteria". The ICO also says UK GDPR "does not cover information which is not, or is not intended to be, part of a filing system." Unstructured paper records held by public authorities are a separate case.

Some counsellors read this as a loophole for a private notebook. Be careful. Whether notes are "structured" depends on the facts, and anything you type up, scan or email is electronic. BACP's GDPR FAQ also says paper records "are not recommended and should be used only in extreme circumstances."

What a client can ask for, and what you may hold back

The ICO guide sets out the main rules for a subject access request (SAR):

• You must respond "without undue delay, and within one month of receipt of the request".
• You can extend by up to two further months if the request is complex or the person has made several requests. You must explain the extension within the first month.
• In most cases you cannot charge a fee.
• You do not have to provide information that would reveal another person, unless that person consents or it is reasonable to disclose without consent.

That last point matters in counselling, where notes often name partners or parents. The ICO sets a process for deciding. It is not a blanket exemption.

The serious harm test for health information

The ICO's guidance on health information describes an exemption where disclosure "would likely cause serious harm to the physical or mental health of any person." Who can apply it depends on whether you count as a "health professional".

Section 204 of the Data Protection Act 2018 gives the list. It includes registered medical practitioners, registered nurses and midwives, people registered as members of a profession covered by the Health Professions Order 2001 (on our reading, the professions regulated by the HCPC, such as practitioner psychologists and arts therapists) and child psychotherapists. On our reading, counsellors and psychotherapists in general are not named, unless they also hold one of the listed registrations. This is a reading of the text, not a legal ruling, so check your own position.

According to the ICO, if you are not a health professional, you must not disclose health information in a SAR unless you are satisfied the person already knows it, or you have obtained, within the last six months, an opinion from the appropriate health professional that the serious harm test is not met. The appropriate health professional is the one currently or most recently responsible for the person's diagnosis, care or treatment. In practice this is a narrow route, and you should take advice from your insurer, your professional body or a data protection adviser before relying on it.

Do not edit notes after a request

GPiA 065 warns that it is "an offence to make any amendment with the intention of preventing disclosure." Once a request arrives, the notes stay as they are. For a step by step guide to answering a request, see our article on subject access requests for therapy notes in the UK. For how the same question works under French law, there is our France version on patient access to therapy notes.

How to write when the client may read it

If you write every note expecting the client could read it, a SAR stops being frightening. Some habits help.

• Describe, then interpret, and label which is which. "Client said she had not slept for three nights" is a fact. "I wondered whether this was linked to the anniversary" is your hypothesis. Keep them visibly apart.
• Use the client's words where they matter.
• Write about the work, not the person's character. "Became angry when we discussed the ending" reads very differently from "difficult and hostile".
• Keep your own feelings in a reflective frame. Where the therapy depends on the practitioner's reflexivity, BACP GPiA 065 says there are "good professional grounds" for including these reflections in the notes "in so far as they are relevant to the work being undertaken." Write them so that a client would see a professional thinking, not a private reaction.
• Record risk and actions plainly. What was disclosed, what you did, who you contacted and why.
• Minimise third parties. Use initials or roles ("her manager") where full names add nothing.

If you want a starting structure for the clinical record, our counselling session notes template for the UK and our clinical document templates are written with these principles in mind. For the last entry in a file, see the end of therapy summary template.

Process notes for supervision and training: storage and anonymisation

Process notes are useful. The aim is to keep their benefit while limiting what identifies the client.

Anonymise properly

The ICO is clear on the difference. Data is only anonymised if individuals can no longer be identified by any reasonably available means. Otherwise it is still personal data. Swapping a name for an initial does not get you there. Age, job, family make-up and an unusual event can identify someone, especially to a supervisor or classmate who lives locally.

BACP's GDPR FAQ adds that anonymising records "is the same as deletion because anonymised data is not personal data". That is a high bar. For supervision and coursework:

• use a code or reference number rather than a name or initials (GPiA 065 mentions client reference numbers)
• change or remove details that are not needed for the learning point, such as job, town, exact ages and dates
• never include contact details or dates of birth
• keep the key that links the code to the client inside your secure clinical file, not with the process notes
• check your course's rules on what may be submitted, who will read it and how long it is kept

Store them like the rest of the file

Clause 3.2(b) of the 2026 framework asks for records to be stored securely and in line with data protection law. Process notes that can still identify a client need the same protection as the clinical record. That means an encrypted device or service, access limited to you, and a clear place in your retention policy.

Decide how long they live

Data protection law does not set a fixed retention period, as BACP's GDPR FAQ notes. You decide, and you tell clients. One option is to destroy process notes once supervision or the assignment is done, while keeping the clinical record for the full retention period. Whatever you choose, write it down and apply it consistently. Deleting notes under a normal retention policy is very different from editing them after a request arrives.

Tell clients in your privacy notice

Clause 3.1 of the 2026 framework expects a privacy notice that explains what rights people have over their data. Mention that you take anonymised material to supervision, and, if you are in training, that anonymised material may be used for coursework.

How Delta fits in

Delta is an AI assistant for mental health and allied health practitioners. During the session it transcribes what is said, then prepares a session report that you review and correct. You can also dictate observations right after the session, or add written notes. The report goes into the client's file, so the follow-up is in one place, and it takes account of your profession and approach, such as person-centred or psychodynamic work.

Your reflective process notes for supervision remain yours to write. Review each Delta draft with the habits above before you validate it. On security, Delta's data is hosted in France with a host certified for health data (HDS, the French health data hosting certification). AI processing, transcription included, runs on servers in France. The client's name and identifying details are pseudonymised before AI processing. No audio file is kept. Data is never used to train models, and it is encrypted in transit and at rest. As with any provider, ask for the data processing agreement before you start. More on the Delta page for therapists.

Sources

• BACP, Ethical Framework for the Counselling Professions 2026 (PDF)
• BACP, Good Practice in Action 065: Confidentiality and record keeping within the counselling professions (January 2024)
• BACP, FAQs about UK GDPR and the Data Protection Act 2018
• BACP blog, Notes and record keeping (20 March 2026)
• ICO, A guide to subject access
• ICO, Right of access: health information
• ICO, How do we find and retrieve the relevant information?
• ICO, What is personal data?
• UK GDPR, Article 4 (definitions), legislation.gov.uk
• HCPC, The professions we regulate
• Data Protection Act 2018, section 204, legislation.gov.uk