ENNL
Menu
← All articles

Data Processing Agreement for coaches: when and how to arrange it

Data Processing Agreement for coaches: when and how to arrange it

Coach managing client data agreements across different devices

As a coach, you need a data processing agreement as soon as a supplier processes your clients' personal data on your behalf. Do you work with practice software, an accounting programme or a video-calling tool that sees or stores client data? Then a data processing agreement is usually mandatory. This follows directly from Article 28 GDPR and is confirmed by the Dutch Data Protection Authority.

You don't have to sort this out in a single day, but you do need to take it seriously. Get these steps underway today:

  • Check which suppliers have access to client data: your practice software, your email programme, your accountant.
  • Request the data processing agreement from each supplier, or send a model yourself if one isn't available.
  • Store the signed agreement centrally, not loose in your inbox among a hundred other messages.
  • Don't simply drop a supplier who refuses to sign, but first find an alternative before you switch.

Further on you'll read exactly what such an agreement must contain, which suppliers usually need a data processing agreement, and how to arrange this as a coach in just a few steps.

Key insights

A data processing agreement is mandatory as soon as a supplier processes client data on your behalf, and Article 28 GDPR sets out precisely what it must contain.

Point Details
Determine your supplier's role Establish whether the supplier acts on your instructions or determines the purpose and means itself.
Check the Article 28 components Review the subject matter, duration, security, sub-processors and data breach procedure in every contract.
Prioritise suppliers with direct data access Start your inventory with practice software and accounting parties.
Exantur supports you with EU hosting and a data processing agreement Use this as part of your central data processing, not as a full GDPR guarantee.

Table of contents

What exactly is a data processing agreement for coaches?

A data processing agreement for coaches is a written contract between you as a coach and a supplier that processes your clients' personal data. Think of a software company that hosts your session notes, or an accountant who processes invoices containing client names.

The GDPR recognises two roles. You are the data controller: you decide why you collect data and how you use it. The supplier is the processor: they act only on your instructions and may not use the data for their own purposes. The Dutch Data Protection Authority describes this distinction as the core of Article 28 GDPR.

Unsure about a supplier's role? Ask these questions:

  • Does the supplier decide for themselves why and how data is used, or do they only follow your instructions?
  • Can an employee of the supplier view client data via support or log files?
  • Does the supplier sell or reuse data for their own marketing?
Role Who determines the purpose and means Example in a coaching practice
Data controller You, as the coach You decide which client data you record and why
Processor The supplier, on your instructions Practice software that stores session notes for you
Borderline case Depends on the contract An accountant who also gives their own advice based on your data

When do you as a coach need a data processing agreement?

The rule of thumb is simple: if a supplier has technical access to client data, a data processing agreement is usually mandatory. This is also confirmed by Sens Juristen in their explanation of software suppliers and the GDPR.

Clear yeses:

  • Practice software in which you store client names, session notes or intake forms.
  • Video-calling tools that store recordings or chat history.
  • Accounting software with invoices in your clients' names.
  • Email marketing tools with contact lists of clients or prospects.
  • Payment processors that handle transactions containing client data.

Clear noes:

  • A supplier of office supplies who never sees client data.
  • A web hosting party without access to your client database, purely for your business-card website.

Borderline cases often arise with support and analytics. Does a support employee have access to log files containing client names? Does a tool analyse usage data that can be traced back to individual clients? Then there's a good chance that processing does take place after all, even if the supplier claims to provide "only infrastructure". In that case, don't sign blindly. Ask for a data processing agreement and find an alternative if the supplier refuses.

What must the agreement contain as a minimum?

Article 28 GDPR lists what a data processing agreement must cover. Among other things, the Dutch Data Protection Authority mentions arrangements regarding the subject matter, duration, nature and purpose of the processing, and what happens to the data once the contract ends. Review these points for every agreement you sign:

  • Subject matter, duration, nature and purpose: why the supplier processes data and for how long. Ask: is this described concretely, or only in vague, general terms?
  • Types of personal data and categories of data subjects: which data (names, contact details, session notes) and about whom (clients, prospects).
  • Instructions: the supplier may only process according to your written instructions, not at their own discretion.
  • Confidentiality: the supplier's employees must be bound by confidentiality.
  • Security measures: which technical and organisational measures the supplier takes, such as encryption or access control.
  • Sub-processors: whether the supplier may engage third parties, and under what conditions.
  • Support with data subjects' rights: whether the supplier helps you with a client's request for access or deletion.
  • Data breach procedure: within what timeframe the supplier reports a data breach to you.
  • Deletion or return: what happens to the data once the contract ends.
  • Right to audit: whether you can request evidence or logs to verify compliance.

Standard clauses on confidentiality and security are usually non-negotiable with large, established suppliers. Do, however, always negotiate on sub-processors and the reporting timeframe for data breaches. Suppliers sometimes leave those points too vague.

Typical processors for coaches and how to inventory them

Most coaches work with a handful of suppliers that actually see client data. Think of:

  • Practice software or a CRM in which you keep client files.
  • Software for session notes and progress reports.
  • Video-conferencing tools for online sessions.
  • Cloud storage for documents and assignments.
  • Payment processors and invoicing software.
  • Your bookkeeper or accountant.
  • Email marketing tools for newsletters to clients.
  • Online forms for intake or registration.

To take stock, ask five questions per supplier: which data this party sees, where it is stored, who has access, whether a data processing agreement already exists, and when it was last reviewed. The Dutch Data Protection Authority offers a sample list you can use as a starting point.

On that basis, build a simple supplier register with these columns: supplier name, contact person, type of data, access level, data processing agreement in place (yes/no), date of last review. Start with suppliers that can directly view client data or store it for a long time. Those are the biggest risks.

A pair of hands keeping track of a digital supplier list.

Step-by-step plan: how to arrange a data processing agreement

You won't arrange a data processing agreement in a single phone call, but the process is manageable if you break it into steps.

  1. Take stock and prioritise. Build the supplier register from the previous section and rank suppliers by risk: first those with direct access to client data.
  2. Request the existing agreement. Larger suppliers usually already have a standard agreement ready. Check it against the Article 28 points from this guide.
  3. Negotiate or accept, and sign. Are crucial points missing, such as the reporting timeframe for data breaches? Ask for adjustment. If everything is complete, sign digitally and keep a copy.
  4. Store centrally and schedule an annual review. Put all signed agreements in one folder or system, not scattered across inboxes.

Who does what? You as the coach take the initiative and manage the register. Contact smaller suppliers yourself; with large software companies you'll often find a standard agreement on their website. Engage a lawyer if in doubt about sub-processors, international data transfers, or with a supplier that refuses to sign. Some coaches opt for a combined document: a service agreement with the processing arrangements built into it. That can be practical, as long as the processing obligations don't become subordinate to other provisions, as EML Juridisch Advies emphasises.

For every agreement, record: the signing date, which data the agreement covers, and the contact person at the supplier. That saves you time at the next review.

Pro tip: Set an annual reminder in your calendar to check all your data processing agreements in one go. New features in your software or a new service may mean the arrangements are no longer accurate.

Sub-processors, data breaches and audits: what if something goes wrong

A sub-processor is a third party that your supplier engages, for example a cloud service on which your supplier's software runs. The supplier may only engage a sub-processor with your consent or after prior notification, as laid down in the data processing agreement.

Strict arrangements apply in the event of a data breach. The Dutch Data Protection Authority states that you must agree with your processor the timeframe within which they report a breach, so that you can act in time towards clients and the supervisory authority. In the event of a breach, always ask for written evidence: what happened, which data was affected and which measures were taken.

For audits, the rule is: you may reasonably request evidence, such as security reports or logs, but not every week. Once a year is customary, unless there is specific cause.

Does a supplier fail to cooperate with these arrangements? Consider that a warning sign and find an alternative.

Sub-processors, data breaches and audits: what if something goes wrong — overview diagram

Timeline and costs: what to expect

Reckon on the following guide:

  • Inventory of suppliers: 1 to 2 weeks, depending on how many tools you use.
  • Requesting and negotiating agreements: 1 to 4 weeks, as some suppliers respond slowly.
  • Archiving and annual review: ongoing, with a fixed moment each year.

The costs usually stay limited. If you only use standard agreements from well-known software suppliers, the costs are low: mainly your own time. If you want legal review of bespoke clauses, the costs rise somewhat, depending on the complexity of your supplier network. Digital signing tools usually add a modest cost.

Pro tip: Use a model data processing agreement as a starting point, such as those found on freelancer advice pages, and reserve a lawyer only for the clauses that really require customisation.

How Exantur supports the data processing agreement and privacy for coaches

Exantur offers coaches EU hosting, a data processing agreement and a secure coachee portal as part of the product. This helps with your own processing obligations, but does not replace them. In concrete terms, for your practice this means:

  • Client data, session notes and documents stay in one central place, which makes the inventory for your supplier register easier.
  • The secure coachee portal gives clients access to their own data themselves, which helps with access requests.
  • The signed data processing agreement with Exantur is on record as supporting evidence for your own file.

Using software such as Exantur does not automatically make your coaching practice fully GDPR-compliant. You remain responsible yourself for your other suppliers.

A personal note from a coach-focused author

Start small: first arrange the data processing agreement with the supplier that sees the most client data, usually your practice software. Feel free to use a model agreement as a starting point and only seek legal advice when in doubt about sub-processors or international transfers. After that, simply schedule an annual check, so it stays manageable.

Exantur helps you arrange data processing agreements in a practical way

There are various routes to getting your data processing agreements in order: sorting them out separately per supplier, engaging a lawyer for each contract, or keeping everything scattered across folders and inboxes. Exantur takes a different path. Because client data, session notes and documents are already in one central workspace with EU hosting and its own data processing agreement, you don't need to check that one big supplier separately. That saves time at your annual review.

For coaches who want to combine their practice management software with secure data use, that's a direct way to arrange structure and privacy at the same time. Take a look at Exantur's coaching practice management software and start a 14-day trial to see how client management, session notes and the coachee portal work in practice.

Sources

Frequently asked questions

When is a data processing agreement mandatory?

What is a standard data processing agreement?

A standard data processing agreement is a model contract containing the basic clauses from Article 28 GDPR, such as security and confidentiality. Always tailor the model to your own practice before signing.

Can I work as a coach without a qualification?

Coaching is not a protected profession in the Netherlands, so you can work without a mandatory qualification. The obligation to enter into a data processing agreement is separate from this and applies regardless of your training.

What is the business rate for coaching?

Coaching rates vary widely depending on specialisation and experience, and are not set by law. What matters more for your GDPR obligations is not your rate, but whether the suppliers you engage process client data.

Recommendation