Recording and transcribing sessions, what is permitted and what breaches

United Kingdom and European Union, Published 18 August 2026

Four minute read. Published on 18 August 2026. Last reviewed on 18 August 2026. Focus, United Kingdom and European Union.

A note on what this is

This guide is our reading of the law and the published guidance, from a legal and compliance point of view. It is not advice about your practice, and it cannot weigh the particulars that make your situation yours. It also leaves untouched the ethical question that usually sits underneath, which is almost always the harder one. Compliance is the duller half of the problem. It is not the less important half.

In short

Recording a session, whether in the room or online, makes you a controller of special category data, and the transcript is health data in exactly the way the audio is. You need a basis under Article 6 and a separate condition under Article 9. The health care purposes condition is difficult to rely on for transcription, because transcription is rarely necessary to treat anyone, so most practitioners fall back on explicit consent. Explicit consent has to be specific, taken before recording begins, and genuinely withdrawable, which means the audio and the transcript both have to be deletable. In Germany and several other member states, recording without the agreement of everyone present is a criminal offence, not merely a data protection failure. In the United Kingdom, a client may lawfully record you for their own use even when you may not lawfully record them.

The clinical question comes first, and this guide does not answer it

It is worth asking why a practitioner would want a recording at all, because the answer used to be clear and has recently changed. Recording has been part of training and accreditation for decades. BABCP, for one, expects recordings of clinical sessions for accreditation supervision and treats alternatives as fallbacks for settings where consent is genuinely hard to obtain. Nobody thought of that as a technology question. It was a learning question.

What is new is that the reason has shifted from learning to administration. A transcript produced so that you do not have to write notes is doing something different in the room from a recording your supervisor will listen to with you, and what that difference does to the work is a clinical matter. This guide sets that aside on purpose. It answers what is permitted and what breaches. Whether it is a good idea belongs in supervision.

Four situations, not one

Practitioners tend to ask about this as a single question. It is four, and the answers diverge sharply.

One, you record an in person session with consent

You are the controller. The audio and the transcript are both special category data, and both need a basis under Article 6 and a condition under Article 9.

The crux is which Article 9 condition. The health care purposes condition carries a necessity test, and transcription is difficult to describe as necessary for treatment, because notes can be and always have been written without it. That pushes most practitioners onto explicit consent, which is a weaker foundation, because it can be withdrawn.

Explicit consent has to be specific and granular. Consent to being recorded is not consent to having the audio processed by a third party transcription service, and a signature on a general therapy agreement does not carry it. It must be obtained before any recording or transcription begins.

The older regulatory position was that consent rarely works in a clinical setting because of the imbalance of power. The European Data Protection Board softened this in 2026, indicating that being a patient does not by itself prevent consent being freely given, and that the problem arises where capacity is severely affected. That guidance was written about scientific research. Reading it across to psychotherapy is a reasonable inference rather than a settled rule, and we would not build a practice on it alone.

Because consent is your condition, withdrawal has to be real. If a client changes their mind in session ten, the audio and the transcript from session three have to go. Build the deletion route before you build the recording route.

The supplier is a processor. You need a processing contract, and you need to know where the audio sits, who the sub processors are, and whether anything is used to improve the vendor's models.

Two, you record an online session

Everything above applies, with one addition that catches people out. The platform is already processing the audio in order to transmit it. That processing is covered by whatever you agreed with the client for the session itself. Recording is a new purpose, and a new purpose needs its own justification. The lawful basis for holding the session is not the lawful basis for keeping a copy of it.

There is a precise point here worth knowing if any part of your practice touches Germany. Transcription in itself, understood as writing down the spoken word, does not necessarily amount to a recording under the criminal provision. But transcripts are generally held for a period on the provider's servers, and that storage usually does make it a recording. The distinction between transcribing and recording is thinner in practice than it sounds in a sales page.

Three, recording without consent

Two versions of this, with the same destination.

You record and do not tell the client. In the United Kingdom, no criminal offence arises from recording a conversation you are a party to, and the domestic purposes exemption is no help to you, because you are acting professionally rather than personally. What you have is processing with no lawful basis, a breach of confidence, and a matter your professional body would take seriously. In Germany, add a criminal offence under section 201 of the Criminal Code, carrying up to three years or a fine, prosecuted on the complaint of the person recorded, with professional secrecy obligations sitting on top. Being a participant in the conversation gives you no privilege there. Several other member states take the same all party approach.

You record with consent and the client later withdraws it, and you keep the file anyway. From the moment of withdrawal you are in the position described above.

Four, the client records you

A client tells you at the start of session six that they have been recording the sessions. Or you notice the phone.

In the United Kingdom, a person recording a conversation they are a party to, for their own use, is generally lawful, and sits outside UK GDPR under the domestic purposes exemption. Data protection law gives you no lever, because it does not apply to them. The exemption falls away if they publish or share the recording, at which point they become a controller with all that follows.

So there is an asymmetry that is worth saying out loud. In the United Kingdom, your client may lawfully do the thing you may not. In Germany, and in other all party consent states, the position reverses and the client recording you without your agreement commits an offence.

Because the data protection route is closed in the United Kingdom, this belongs in the working agreement and in the room. It is a clinical and contractual matter, and it is much easier to have agreed a position in writing at the start than to negotiate one in the moment.

What is genuinely unclear

We would rather say so than pretend otherwise.

Whether the health care purposes condition could ever cover AI transcription. There is an argument that documentation is part of treatment. No regulator has tested it.
Whether the 2026 softening on power imbalance reads across from clinical research to psychotherapy.
Whether a solo practice needs a data protection impact assessment for this. The threshold turns on high risk, and new technology applied to health data is a strong indicator, though one practitioner is not obviously operating at scale. Doing one costs an afternoon and settles the question.
How far the German position generalises. It does not represent the European Union as a whole, and national criminal law on recording varies more than data protection law does.

What to do this week

Write down why you want a recording. If the honest answer is documentation convenience rather than supervision or training, your legal footing is weaker, and you should know that before you start rather than after.
Take the permission separately. A dated, specific, revocable consent to recording and to transcription by a named service, obtained before the first recording, kept apart from the working agreement.
Ask the supplier three questions in writing. Where the audio and the transcript are stored, who the sub processors are, and whether anything is used to train models. Get a processing contract before you upload a single session.
Decide the deletion rule for the audio, and make sure you can actually honour a withdrawal, including for sessions already transcribed.
Add a line to your working agreement about the client recording sessions, so the question is settled before it arises.

References

About this guide

Written for practitioners working in the United Kingdom and the European Union. National criminal law on recording varies considerably between member states, and this guide names the German position as an example rather than a European standard. Last reviewed on 18 August 2026.

This guide is our reading of the law and the published guidance, from a legal and compliance point of view. It is not advice about your practice, and it cannot weigh the particulars that make your situation yours. It also leaves untouched the ethical question that usually sits underneath, which is almost always the harder one. Compliance is the duller half of the problem. It is not the less important half.

Related guides

Last reviewed 18 August 2026. General information for practitioners, not legal advice.