ENNL
Menu
← All articles

Data minimisation in coaching: how to keep only what you need

Data minimisation in coaching: how to keep only what you need

Coach reviewing the questions on an intake form

Data minimisation means that, as a coach, you only collect and keep the personal data you genuinely need for the coaching process. No more than that, and no longer than necessary. That sounds simple. In practice, data is often scattered across an intake form, a notebook, your inbox, WhatsApp and a few Word files. In this article you will read what the GDPR (the General Data Protection Regulation, the European privacy law) requires of you. You will also get a step-by-step plan you can start using this week.

Exantur
Work with fewer scattered client records
Exantur brings client relationships, session notes and process documents together in one workspace, with EU hosting and a data processing agreement available.

TL;DR

  • Data minimisation is one of the basic rules of the GDPR: you only process data that fits a predefined purpose.
  • Keeping data “just in case” is not allowed. Whatever you no longer need, you delete or anonymise.
  • Coaches often hear sensitive information, such as about health. Stricter rules apply there, so be especially sparing with it.
  • Start with your intake form and your session notes: that is where you gain the most.
  • Software can help, but you remain responsible. Always conclude a data processing agreement with your software provider.

Table of contents

What data minimisation means for a coach

The GDPR has six basic principles. They are set out in Article 5 of the law. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) explains that everyone who processes personal data must comply with these principles and must also be able to demonstrate it. Data minimisation is one of them.

The legal text states that personal data must be adequate, relevant and limited to what is necessary for the purpose. For a coach, that comes down to three questions:

  1. Adequate: do I have enough information to coach well?
  2. Relevant: does this information genuinely relate to the process?
  3. Limited: can I achieve the same purpose with less data?

The Irish supervisory authority sums it up briefly: you collect and process only data that is necessary for the purpose for which you process it. So it is not only about deleting. It already starts with the question of what you ask in your intake.

Data minimisation is closely linked to two other principles. The first is purpose limitation: you decide in advance what you will use the data for. The second is storage limitation: you do not keep data longer than necessary. Without a clear purpose, you cannot determine what is “necessary”. That is why everything starts with that purpose.

Why it matters all the more in coaching

In a coaching session, a coachee often says more than in an ordinary customer conversation. About a burnout, a divorce, sleep problems, conflicts at work or doubts about their own career. Some of this falls under special category personal data, such as data about health.

For that data, the GDPR imposes a prohibition on processing, with a limited number of exceptions. One of these is explicit consent from the person themselves. For a coach, that is the key point: only write down health information if it is truly necessary for the coaching goal. Are you in doubt about whether you may record certain sensitive information, for example if you work with coachees who are in a reintegration process? Then ask a privacy lawyer or your professional association for advice.

There are three more reasons why less data works better:

  • Less harm in the event of a data breach. The European privacy supervisory authorities (EDPB) state in their guidelines on privacy by design that you set up your systems and working methods so that, by default, only necessary data is processed. What you do not keep cannot leak either.
  • Better data. A small, up-to-date file is easier to keep accurate. And accuracy is also an obligation under the GDPR.
  • More trust. If you can explain to a coachee why you are asking for something and how long you will keep it, they feel safer. That is good for the coaching relationship.

Which data do you really need?

There is no fixed list for every coach. A career coach needs different information than an executive coach who works on behalf of an employer. Use the table below as a starting point. For each row, ask yourself: what do I do with it?

Data Usually needed? More sparing alternative
Name and email address Yes, for contact and appointments None
Phone number Often Only ask if you actually call or text
Billing address Only if the coachee pays themselves When paid by the employer: the employer's details
Date of birth Rarely Leave out, or only ask for age group if relevant
Citizen service number (BSN) No Do not ask
Copy of ID document No Do not ask
Medical history Rarely Only what the coachee considers relevant themselves, with explicit consent
Data about partner or children Rarely Describe without names (“partner”, “eldest child”)
Coaching question and goals Yes, the heart of the process None
Assessment results Yes, if you use them in the process Only keep as long as the process is running
Verbatim quotes from sessions Rarely Summarise in your own words

The AP advises entrepreneurs, as a first step, to determine which personal data you process and why. This table is a practical version of that step, tailored to coaching.

Step-by-step plan: data minimisation in seven steps

Seven steps to limit data in coaching

1. Write down your purposes

In a few sentences, note what you use data for. For example: “scheduling appointments”, “guiding the process”, “sending invoices” and “reporting to the client organisation”. Every piece of data you keep must fit one of those purposes. Does it fit nowhere? Then you do not need it.

2. Map what you currently keep

Go through all your locations: your inbox, your phone, your chat apps, your laptop, your cloud storage, paper notes and your bookkeeping. For each location, write down which data is stored there. Many coaches are shocked by how many copies are floating around. An intake form that came in as an attachment is often in your email, in your downloads and in a folder on your laptop.

3. Make your intake form shorter

Remove every question you do not use. A good test: have you ever gone back and read the answer in the last ten processes? If not, scrap the question. Make sensitive questions optional and explain in one sentence why you are asking them. The French supervisory authority CNIL emphasises that you only collect data that is appropriate, relevant and necessary for the purpose you set when collecting it. So that moment of collection is the moment to be critical.

4. Write session notes sparingly

Your notes are a working document for you, not a transcript. Write down what you need for the next session: what you observed, what insight there was, what the coachee is going to do. Leave out details that add nothing to the purpose. Where you can, use descriptions instead of the names of third parties. In our guide to writing session notes you can read how to keep notes short and usable.

A handy technique is pseudonymisation. The GDPR describes this as processing data in such a way that it can no longer be linked to a person without additional information, which is kept separately. For a coach, that can be as simple as working with a code in your notes, while the name is stored in another, secure place. Note: pseudonymised data remains personal data.

5. Clean up loose channels

Chat apps and email are handy for a quick question. But they are a poor place for content. Agree with your coachee that personal topics are not handled via WhatsApp. Put what is important into your file and remove the rest from your chat and inbox. That way you have one place where everything is, instead of five.

6. Agree on retention periods and actually clean up

For each type of data, decide how long you keep it. For example: substantive notes up to a fixed period after the end of the process, invoices for as long as the tax retention obligation requires. Ask your bookkeeper about the correct period for your records. Set a fixed date in your calendar, for example every quarter, to review completed processes. Whatever is no longer needed, you delete or anonymise. That also applies to paper: shred it, do not put it in the recycling bin.

7. Record it and tell your coachee

Put your choices in your privacy statement and in your coaching agreement. Explain which data you ask for, why, and how long you keep it. With the coaching agreement generator you create a basis that you complete yourself. Want to know whether you have all your obligations lined up? Then go through the GDPR checklist for coaches.

Example: an intake before and after

Suppose you are a career coach. Your old intake form asks for name, address, date of birth, phone number, marital status, number of children, current employer, salary, medical complaints, medication use and the coaching question.

After a critical look, this is what remains:

  • name and email address (for contact);
  • phone number (optional, only if you call);
  • current role and sector (needed for a career question);
  • the coaching question and what the coachee wants to achieve;
  • an open, optional question: “Is there anything in your situation that I should know in order to support you well?”

Date of birth, marital status and salary are gone. They fit none of your purposes. Medical complaints and medication are no longer asked as standard. If the coachee wants to share something about it themselves, they can do so in the open question. You only write it down if it is needed for the process, and you ask for explicit consent to do so.

The result: a form with five questions instead of eleven. The coachee is done faster, you have less to secure, and the conversation starts with what really matters.

Choosing software that helps you

Good software makes data minimisation easier, because everything is in one place. Still, the AP says clearly: as a coach, you are the data controller. That means you are ultimately responsible, even if a software provider stores the data for you. So a secure tool does not automatically make your practice GDPR-proof.

If you have a provider process personal data, a data processing agreement is mandatory. According to the AP, in it you record, among other things, the subject, the duration, the nature and the purpose of the processing and the type of personal data. It should also cover how the provider secures the data and how they help if a coachee asks for access or deletion.

When choosing software, pay attention to these points:

  • Where is the data stored? Storage within the EU makes the arrangements clearer.
  • Who can access it? Your practice's data must be separated from that of other practices.
  • How do you log in? Choose software with MFA: logging in with an extra code on your phone, in addition to your password.
  • Is there a data processing agreement? Without that agreement, you cannot use the tool in a proper way.
  • Can you take notes sparingly? Structured notes help you record only what matters.
  • How does AI work, if there is any? Ask which data is sent to an AI model.

The Irish supervisory authority advises small organisations first to carry out a risk analysis of the data you hold and then to take appropriate measures. Do the same when choosing software: first look at what you keep, and only then at which tool best suits it.

Our view: less data, better coaching

We see that many coaches treat privacy as something for later. First build the practice, then get the paperwork in order. But data minimisation works the other way around. It starts with how you set up your work: what you ask at intake, where you write your notes, which channel you use between sessions.

That is why we built Exantur around the coaching relationship itself, not as a general CRM system (software to track customer contacts, usually built for sales). A coach does not need sales opportunities, but an overview per process: goals, sessions, agreements and progress. If everything is in that one place, you no longer need to keep copies in email and chat.

Our view: less data, better coaching — overview diagram

We also notice that structure helps you be sparing. Someone who records a note as an observation, insight, breakthrough or action point naturally writes more briefly and purposefully. There is less room for verbatim stories that you will never read again later.

And we are honest about the limit: software supports GDPR-aware working, but does not automatically make a practice fully GDPR-proof. Your choices about what you ask, what you write down and what you clean up continue to make the difference.

- Martijn

How Exantur helps you work sparingly

Exantur is a workspace for solo coaches and small practices. You manage coachees, programmes, structured session notes, goals, check-ins and accountability (keeping track of whether agreements between sessions are being met) in one place. Data is hosted in the EU, in Frankfurt. Practices are kept separate from each other, you log in with MFA, and a data processing agreement is available. Coachees see their own goals, check-ins and shared documents in their own client portal, so content no longer has to go via chat or email. The optional AI assistant works on your own Anthropic key and does not send any data that can identify a coachee to the model. Read more about GDPR-aware working with Exantur or view the plans: Mini costs €19 per month or €190 per year, Starter €49 per month or €490 per year. You can try Exantur for free first.

Frequently asked questions

Does data minimisation also apply to a solo coach?

Yes. The GDPR applies to anyone who processes personal data as part of a business, even if you work alone. There is no exemption for small practices. You can, however, tailor the measures to the size and risks of your practice.

Can I keep old session notes in case a coachee comes back?

Not just like that. Keeping data “just in case” does not fit the GDPR. Set a retention period, explain it in your privacy statement, and when wrapping up the process you could ask whether the coachee would like you to keep a short summary.

Should I leave out health information entirely?

Not always, but be very sparing with it. Health data are special category personal data with stricter rules. Only write down what is needed for the coaching goal, with explicit consent, and ask a privacy lawyer for advice if you often work with this kind of information.

How do I know whether my practice has the basics in order?

Start with the coaching privacy check. It shows where you are already doing well and where you can still take steps. Combine that with the steps in this article: write down your goals, map your data, shorten your intake and schedule regular clean-up moments.

Sources

Recommendations