Therapy practice management software in Ireland: a GDPR checklist

Practice management software for a therapist is not an ordinary business tool: it holds session notes, diagnoses and contact details. Before you compare features, compare what the vendor must do for you under GDPR. This checklist covers the checks that apply to a private practice in Ireland.

A note on this guide: it is general information for practitioners, not legal advice. Where a point depends on your professional body or your own circumstances, we say so rather than guess.

Why the vendor question matters more than the feature list

When you put client records into a cloud system, you are normally the controller of that data and the software company is your processor. Article 28 of the GDPR says a controller may only use processors that provide sufficient guarantees of appropriate technical and organisational measures, and that processing by a processor must be governed by a binding written contract, which can be in electronic form. In other words: the contract is not paperwork you can skip, it is a legal requirement that sits between you and your software.

What the processor contract must cover

Article 28 lists the minimum contents. For a therapy practice, these are the lines worth looking for in a vendor's data processing terms:

• Documented instructions only. The processor handles client data only on your documented instructions, including for any transfer outside the EU.
• Confidentiality. Staff who can reach the data are bound by confidentiality.
• Security measures as required by Article 32.
• Sub-processors. The vendor may not hire another processor without your prior written authorisation, specific or general. With a general authorisation, it must tell you about additions or replacements and give you the chance to object.
• Help with client rights and breaches. The vendor assists you with access, rectification and erasure requests, and with your breach-notification duties.
• Deletion or return at the end. When the service ends, the vendor deletes or returns all personal data at your choice, unless the law requires it to be kept.
• Audit information. The vendor makes available the information needed to show compliance and allows or contributes to audits.

If a vendor cannot show you terms along these lines, treat that as an answer.

Security: what Article 32 actually names

Article 32 asks for measures appropriate to the risk and gives examples, among them the encryption of personal data, the ability to ensure ongoing confidentiality, integrity, availability and resilience, the ability to restore access to personal data promptly after a physical or technical incident, and a process for regularly testing the effectiveness of the measures. Turn those into plain questions for a vendor:

1. Is client data encrypted in transit and at rest?
2. Where is it hosted, and can the vendor confirm EU hosting in writing?
3. Can each practitioner see only their own clients, if you work in a group?
4. What happens if the vendor has an outage or loses data: how is it restored, and how quickly?
5. Is there an activity log showing who opened or changed a record?

Special category data and professional secrecy

Health data is a special category under Article 9: processing is prohibited by default unless an exception applies. The exceptions most relevant to a therapy practice are explicit consent for specified purposes and processing necessary for the provision of health care, which Article 9(3) allows where the data is handled by, or under the responsibility of, a person subject to professional secrecy under Union or Member State law. Whether a particular practitioner falls into that wording, and which basis is the right one for your service, is a question for your professional body or a data protection adviser. What you can do yourself is document the basis you rely on and make sure your consent wording matches it.

Breach readiness belongs in the buying decision

A processor must tell the controller without undue delay after becoming aware of a breach, so that you can meet your own deadline. That deadline is, where feasible, 72 hours from when you become aware, unless the breach is unlikely to result in a risk to people's rights and freedoms. Ask the vendor how and how fast it would tell you, and how you would get the details you need for the report. We cover the full procedure in our guide to building a data breach plan for your practice.

Practical questions beyond GDPR

• Export. Can you export all client records in a readable format without help from the vendor?
• Fit for your way of working. Online sessions, group practice, several locations, part-time hours.
• Clear pricing and the right to cancel without a long contract.
• Honest scope. Be wary of tools that promise everything. For example, Nerela issues payment receipts for your clients rather than tax invoices, and says so; check that a vendor is just as clear about what it does not do.

A short scoring sheet

Give each vendor one point for every yes: written processor terms, sub-processor notice, EU hosting confirmed, encryption described, role-based access, activity log, restore process, export in a readable format, deletion on exit. A tool that scores below seven is a tool to ask more questions about before any client data goes in. If you want to see how a psychology-specific tool answers these points, you can run the 14-day trial with test data only and check each line yourself.

Sources

All pages below were consulted on 7 November 2026.

• GDPR Article 28: processor
• GDPR Article 32: security of processing
• GDPR Article 9: processing of special categories of personal data
• GDPR Article 33: notification of a personal data breach to the supervisory authority