Data portability in your coaching practice: how to hand over client data

Data portability in your coaching practice: how to hand over client data

A client asks you for “all my data” because she's moving to another coach or wants to keep her own journey. This often concerns the right to data portability: the right to take personal data with you in a form you can easily reuse. This right stems from the GDPR, the European privacy law. It applies to you as a coach too, but not to everything in your file. In this article you'll read which data you must hand over, which you don't, how quickly you have to respond and how to arrange this in your practice before the first request comes in.

In brief

• A client may receive back the data she has given you herself, in a structured, commonly used and machine-readable file.
• The right applies if you process data digitally on the basis of consent or an agreement. With paid coaching, that is almost always the coaching agreement.
• Your own observations and conclusions do not fall under it. Neither do paper files.
• You respond within one month. Only if necessary may you extend that period by two months.
• If you refuse (part of) the request, you explain to the client why.

Table of contents

• What the right to data transfer entails
• When a client has this right
• Which coaching data you hand over and which you don't
• Other people's data and confidentiality
• How to handle a request in six steps
• An example from a career coaching practice
• What this requires of your coaching software
• How we view data portability
• Get your practice in order with Exantur
• Frequently asked questions
• Sources

What the right to data transfer entails

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) is the Dutch privacy supervisor. In plain language, the AP calls data portability the right to transfer data. The idea is simple. People receive the personal data an organisation processes about them in a file a computer can read. They can then use that data themselves or pass it on to another organisation.

For a coach this means: you are the “organisation”. As a solo coach you are responsible for your clients' data yourself. In the GDPR this is called the data controller. If you use software, the provider is usually a processor working on your behalf. So the request comes to you, not to your software company.

Data portability is not the same as access. With access, a client wants to know which data you hold about her. With data portability, she wants to take some of that data with her, in a usable file. Clients often use the terms interchangeably. So briefly check what exactly the client wants before you get started.

When a client has this right

According to the explanation from the Dutch Data Protection Authority, three conditions apply simultaneously:

1. The basis is consent or an agreement. A basis is the legal reason why you are allowed to process data. With a paid coaching programme, that is usually the agreement you enter into with the client.
2. You process the data digitally and automatically. Think of an online intake form, a calendar, email or coaching software.
3. The client has given you the data herself. This can be deliberate, such as answers to a questionnaire. It can also be indirect, through the use of a service, such as the data of booked sessions.

If one of these conditions is not met, the right to data portability does not apply. The client can then often still use other privacy rights, such as access. Do you work with an executive coaching programme that an employer pays for? Then the agreement is sometimes concluded with the employer. In that case, carefully consider on which basis you process the coachee's data. If in doubt, put your situation to a privacy lawyer or a GDPR adviser.

Which coaching data you hand over and which you don't

This is where the trickiest question for coaches lies. A coaching file contains two kinds of information mixed together: what the client tells you and fills in, and what you make of it. The AP makes that distinction between provided and derived data clear: data you derive yourself does not fall under this right.

In an ordinary coaching practice, it looks roughly like this:

A few remarks on this table. The line between “given” and “derived” is not always sharp. An action point the client formulates herself and you write down sits close to her own words. An observation like “avoids conflict with manager” is clearly your conclusion. When in doubt, the question helps: does this information come from the client, or from my own head?

Also note the difference with access. You don't have to hand over your own notes as data portability. That doesn't mean a client can never ask about them. If a client asks to access her entire file, different rules apply. For that, read the AP's explanation on access or seek advice.

Other people's data and confidentiality

Coaching often involves other people. A manager, a partner, a named colleague. With 360-degree feedback, others even deliberately give input about your coachee. The AP says you may refuse a request if transfer adversely affects the rights and freedoms of others. You do then have to explain why you refuse.

In practice this doesn't have to mean you refuse everything. Often it's enough to leave out or anonymise other people's data and simply hand over the rest. For example: the client has written something in a check-in about a conflict with her team leader. That is her own text, which you hand over. But feedback that colleagues gave anonymously you don't simply share, because that anonymity could then disappear.

How to handle a request in six steps

A request usually comes by email or in a conversation. A set form is not required. With these steps you keep it calm and manageable:

1. Note the date of receipt. The period of one month after receipt starts running immediately. For a complex request you may extend that period by two months if necessary. In that case, let the client know in good time.
2. Check who is asking. Does the request come from the email address you know? If in doubt, call back briefly. You don't want to send sensitive data to the wrong person.
3. Ask what the client wants. Does she want to take everything to a new coach, or mainly keep her own answers? That determines what you collect.
4. Collect the data the client provided herself. Look everywhere you store client data: your email, your calendar, your forms, your spreadsheet, your coaching software and your chat app.
5. Provide a usable file. The AP requires a structured, commonly used and machine-readable format. A CSV file or a spreadsheet works for most people. A scanned PDF of a form is less suitable, because a computer can read it poorly. According to AVG Helpdesk Zorg, you must at least give the data subject the option to download the data directly.
6. Record what you did. Write down when the request came in, what you provided and what you didn't, and why. Including this in your processing register is not a legal obligation, but it does help to show that you handle requests carefully, writes AVG Helpdesk Zorg.

Send the file in a secure way. An ordinary email attachment is not ideal for sensitive coaching information. A secured download link or your own client environment is better.

An example from a career coaching practice

Suppose: Sanne has done a six-month career coaching programme with you. She's stopping and continuing with a coach in another city. She emails: “Can you send me all my data?”

You note the date and give her a quick call. She mainly wants to take her intake, her goals and her check-ins with her, so she doesn't have to start over. You collect her contact details, her answers on the intake form, her Wheel of Life scores, the goals she filled in herself and her weekly check-ins. You put that into a spreadsheet with clear columns. Your session notes and your analysis of her DISC profile you don't hand over as data portability, because those are your own conclusions. In your reply you explain that in two sentences. That way Sanne knows what she's getting and why.

The hardest part is often not the law, but the searching. If her data is spread across five tools, this costs you an afternoon. If it's together and it's clear what she filled in and what you wrote, you're done in half an hour.

What this requires of your coaching software

Data portability is above all a matter of order. A few questions you can ask of any tool, including the tools you already use:

• Can you find all data per client? If intake, goals, check-ins and documents are linked to the right client, you don't have to search.
• Can you see who entered something? The difference between what the client fills in and what you note determines what you hand over.
• How do you extract data? Ask the provider how to get a client's data into a common file, and try it out once with a test client.
• Where is the data stored? With hosting in the EU, the data stays under European rules.
• Is there a processing agreement? That is a contract in which the provider promises to handle your client data carefully. Under the GDPR you need one.

If you line up these points, you'll often see that the separate tools are the problem. A spreadsheet here, a form there, notes in a document and appointments in the chat. If you want to go through all obligations at once, use our GDPR checklist for coaches. Do you coach in another field, such as singing? The right to data transfer applies there too, as you can see in the GDPR obligations for vocal coaching.

How we view data portability

We don't see data portability as a troublesome rule, but as a question that belongs with good coaching. Your client entrusts you with her story. Then she may also know what happens to her own words and take them with her when she moves on.

That's why we built Exantur around the coaching relationship, not as an ordinary CRM. A CRM is software for keeping track of customer contacts, often built for sales. In Exantur, intake forms, assessments, goals, check-ins, documents and assignments are linked to the right client and the right programme. You record your session notes as observations, insights, breakthroughs and action points. That keeps it visible what your client supplies and what your professional view is. It's precisely that distinction you need when handling a request for data.

Coachees have their own portal in Exantur. There they see their goals and progress, fill in check-ins and open shared documents. That already gives them insight into their own data during the programme.

We're also honest: software doesn't automatically make your practice fully GDPR-proof. You remain responsible yourself for what you record, what you share and how you handle a request. What software can do is create order, so you can do that well and quickly. Data in Exantur is stored in the EU, in Frankfurt, with two-step verification (MFA) and a processing agreement. You can read more about that on our page about GDPR coaching software.

Martijn

Get your practice in order with Exantur

Want to have client data, notes, goals and check-ins in one place, hosted in the EU? Exantur is practice software for solo coaches and small coaching practices. Packages start at €19 per month (Mini) or €190 per year. After that come Starter (€49 per month), Growth (€99 per month) and Practice (€199 per month). View all packages and prices and start with a free trial.

Frequently asked questions

What is the right to data portability?

It is a person's right to receive back the data they have given to an organisation themselves, in a structured, commonly used and machine-readable file. They can then use that data themselves or pass it on to another organisation. The right stems from the GDPR and applies to coaches too.

Do I have to hand over my session notes to a departing client?

Not under data portability. Your own observations and conclusions are derived data and fall outside this right. If a client asks to access her file, different rules apply. When in doubt, seek advice from a privacy lawyer.

Who is the privacy supervisor in the Netherlands?

That is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). The AP supervises the GDPR in the Netherlands and explains on its website which privacy rights people have. As a coach you will also find reliable explanations there about your clients' rights.

How much time do I have to respond to a request?

You respond within one month of receipt. If the request is complex, you may extend that period by two months. Let the client know within the first month that you need more time and why.

Is a privacy statement on my coaching website mandatory?

You must tell clients which data you process, why, and which rights they have. Most coaches do this with a privacy statement on their website. Also mention how a client can make a request for her data.

Sources

• Dutch Data Protection Authority: Right to transfer data (data portability)
• AVG Helpdesk Zorg: Data portability, how do you hand over the file?

Recommendations

• EU-hosted coaching software, data stays in the EU
• Coaching client portal, branded client experience