Data ownership in coaching: who owns your client records?
Data ownership in coaching: who owns your client records?
No, you cannot legally claim coaching data as property. Dutch law recognises no property right over data: you secure control through the GDPR, solid contracts and technical security measures. As a coach you are usually the data controller, which brings concrete obligations with it. The practical protection of your records therefore lies not in a claim of ownership, but in agreements and measures you set out yourself.
In short:
- Even as a solo coach, you are the data controller the moment you record personal data; so conclude a data processing agreement with every software provider and set your own retention periods.
- After discovering a data breach, you must assess within 72 hours whether a report to the Dutch Data Protection Authority is required and sometimes also inform the coachees involved.
- Set out in supplier contracts whether records will be returned, exported or deleted on departure, which subcontractors are granted access, and how you can switch providers without losing data.
- Database rights can only apply where there is a substantial investment in collecting or structuring data; trade secrets require commercial value and confidentiality measures, while copyright protects creative reporting templates, not raw data.
- Record retention periods in writing and protect records with unique passwords, two-factor authentication, encryption and regular backups, so you can demonstrate your agreements and limit data loss.
Table of contents
- Legal basis: why data is not a ‘thing’ under Dutch law
- The GDPR and your role as a coach: data controller versus data processor
- If ownership isn't possible: what legal protections do exist?
- Contracts and technology: how to set out and protect control in practice
- Practical checklist: concrete steps for this week and structural tasks
- Trust grows with clear agreements
- Frequently asked questions
- Sources
- Working practically with your records in Exantur
Legal basis: why data is not a ‘thing’ under Dutch law
In the Netherlands, ownership exists only in respect of “things”: tangible objects that you can grasp, move or lock away. This is set out in Article 3:2 of the Dutch Civil Code. Data does not fall under this, because it is not tangible. A note file, a progress report or an intake form in your system is therefore not a “thing” in the legal sense, even though it feels like property of your practice to you.
This has a concrete consequence: you cannot “reclaim” data the way you would reclaim a stolen bicycle. This legal route, known as revindication, works only for tangible things. With data it works differently, as shown by the analysis by Marxman Advocaten on ownership of data.
Suppose you transfer a coaching practice to a successor and the previous software provider refuses to release the records archive. Without a property right, you cannot enforce this through property law itself. You do, however, have other routes:
- A contractual agreement on the return of data at the end of the collaboration.
- Invoking your rights as a data controller under the GDPR.
- Possibly invoking specific protective rules, such as database rights.
The GDPR and your role as a coach: data controller versus data processor
As a coach you process personal data: names, contact details, and your coachees' progress and goals. Sometimes this involves special categories, for example health information that comes up during a session. This data calls for extra care.
In almost all cases you are the data controller: you decide yourself why and how you collect and use data. Your software provider is then the data processor: they process data on your behalf, but not for their own purposes. This division of roles is assessed on the basis of who actually determines the purposes and means, not just on the basis of what a contract says, as reported by the Dutch Data Protection Authority regarding the data processing agreement.
Three practical consequences of that role:
- You must have a data processing agreement with every software provider that processes data on your behalf.
- You decide yourself how long you retain data and must be able to explain this.
- In the event of a data breach, you must consider within 72 hours of discovery whether to make a report to the Dutch Data Protection Authority, and sometimes also inform the coachees involved.
These obligations apply regardless of the size of your practice: even as a solo coach with a handful of clients, you are the data controller as soon as you record data.
If ownership isn't possible: what legal protections do exist?
Because classic ownership does not apply, lawyers look to other protective routes. None of these routes applies automatically: they all require specific conditions.
- Database rights protect a collection of data if a substantial investment has been made in it, for example in collecting, verifying or structuring it. Loose, unstructured notes usually fall outside this, as shown by the explanation from aaff on the legal protection of data.
- Data can qualify as a trade secret under the Dutch Trade Secrets Protection Act, but only if it has commercial value and you take reasonable confidentiality measures, such as access restrictions and confidentiality clauses.
- Copyright does not protect raw data, but it does protect creative works arising from data: a self-written reporting template or a unique assessment form may be protected by copyright.
For most coaching practices, contractual protection is the most workable route, simply because database rights and trade secrets impose strict conditions.
Contracts and technology: how to set out and protect control in practice
Because ownership is not an option, the emphasis is on clear agreements and sound security. That starts with your contracts.
Important points to set out in agreements with providers and in your coaching agreement:
- The purpose for which data is processed, clearly described.
- What happens to the data upon termination: return, export or deletion.
- Whether and which subcontractors (sub-processors) are granted access to the data.
- How you can easily switch to another provider without losing your records.
On the technical side, a few basic measures are achievable for any coaching practice: strong, unique passwords, two-factor authentication (a second check alongside your password, such as a code on your phone), encryption of stored data and regular backups. Our own approach to secure coaching software shows what this looks like in practice.
Pro tip: Explicitly ask every software provider to send over the data processing agreement before you take out a subscription, not only afterwards.
Practical checklist: concrete steps for this week and structural tasks
You don't have to arrange this in a single day. A good approach works in layers: first the basics, then structural safeguards.
To tackle this week:
- Check that your privacy statement is up to date and actually informs coachees about what happens to their data.
- Add a privacy section to your coaching agreement, explaining retention periods and the use of data.
- Check with every software provider whether a data processing agreement is available and sign it.
To arrange within a few months:
- Set out how long you retain different types of data, for example session notes, invoices and intake forms.
- Draw up a simple data breach plan: who does what if something goes wrong, and within what timeframe.
- Schedule an annual review of your privacy agreements and supplier contracts.
In the longer term:
- Include exit clauses in all your supplier contracts, so that you can always take your records with you on departure.
- Document your procedures in writing, so that new staff or stand-ins can follow them.
- Periodically carry out an internal audit of who has access to which data.
Practical tools such as the coaching agreement generator or the GDPR check for coaches make the first steps concrete. Workable measures for coaching practices, such as a clear privacy statement and simple technical security, are also explained in practical terms by Coachoverzicht.
Pro tip: Put your retention periods on paper, even if you don't yet have a fixed procedure: a written rule, however simple, carries more weight than a good intention.
Trust grows with clear agreements
A coaching relationship runs on trust, and that trust grows when you are clear about what happens to someone's data. Coachees who know their records are handled carefully dare to share more. You notice that in the depth of sessions.
Orderly record-keeping is not only a legal obligation, it also simply makes for pleasant work. A coach who knows exactly where each note is kept and when a retention period expires works more calmly and more professionally. That structure reflects on the relationship with the client.
— Martijn
Frequently asked questions
Who legally owns coaching data?
No one is the “owner” of data in the legal sense of the word, because data is not a thing under Article 3:2 of the Dutch Civil Code. Instead, the GDPR determines who is responsible for the data: in most cases, you as the coach are the data controller, as explained by Marxman Advocaten.
How do you set out agreements about data in a coaching agreement?
Include a privacy section that explains what data you collect, why, and how long you retain it. Also state what happens to the data when the engagement ends, so this does not become a point of dispute afterwards.
What are the main types of data a coach processes?
Coaches typically process contact details, progress notes and sometimes special categories of personal data such as health information that comes up during a session. Each category calls for appropriate security and a clear basis for processing.
What does good data management involve in a coaching practice?
Good data management includes clear agreements on retention periods, access management, security measures such as encryption and two-factor authentication, and a data processing agreement with every software provider. The Dutch Data Protection Authority provides practical guidelines for this.
What rights do coachees have over their own data?
Under the GDPR, coachees have the right to access their data, the right to correct inaccurate information and the right to erasure when there is no longer a valid reason to retain the data. As a coach, you must be able to handle these requests within a reasonable timeframe.
Sources
- Blog series part 1: is there ownership of data? - Marxman Advocaten
- Data processing agreement | Dutch Data Protection Authority
- How to protect your data legally | aaff
- GDPR for coaches | Coachoverzicht
Working practically with your records in Exantur
A coaching practice calls for more than loose Excel files and scattered notes across different apps. We built the software around the coaching process: from intake to session note to final report, everything stays linked to the right client and the right engagement, in one workspace.
Because privacy plays such a central role in coaching, data is hosted in the European Union and there are technical and organisational measures such as organisation isolation, two-factor authentication and a data processing agreement. The software does not automatically make your practice fully GDPR-compliant, but it can help you lay a structured foundation for meeting your obligations. You can find more on this on our page about GDPR coaching software.
Besides record-keeping, we also handle aspects of the practice such as online booking with automatic reminders, calendar synchronisation, video integration and invoicing via your own payment methods. Coachees get their own portal to stay engaged with their goals, progress and assignments.
Want to see how this works in your practice? View our plans from €19 per month and start the free 14-day trial, at no cost during the trial.