ENNL
Menu
← All articles

Privacy in your coaching contract: what to arrange and how to write it down

Privacy in your coaching contract: what to arrange and how to write it down

Coach and coachee agree on privacy rules

In your coaching contract, you arrange privacy in two parts. The first part is confidentiality: what your coachee tells you stays between the two of you, except in situations you name in advance. The second part is how you handle personal data under the GDPR: which data you record, why, how long you keep it, who can see it, and what rights your coachee has. Many coaches only arrange the first part. Below you'll read, topic by topic, what belongs in your contract, with sample texts you can adapt yourself.

Exantur
Protect confidential coaching data
Exantur helps you manage coaching data in one place, with EU hosting, access security, and an available data processing agreement.
Discover Exantur

In brief

  • Confidentiality is an agreement between you and your coachee. Privacy under the GDPR is a legal obligation. Your contract arranges both.
  • For most data, the legal basis is the performance of the agreement. When it concerns health or other sensitive data, stricter rules apply.
  • Coaching on behalf of an employer? Then write down what the client does and does not get to hear, and that your coachee sees it first.
  • Set out how long you keep session notes and how you secure them. Keep nothing longer than necessary.
  • If you use software that stores coachees' data, you need a data processing agreement with the supplier.

Table of contents

Confidentiality and privacy are not the same

Many coaching contracts have a sentence like: "Everything discussed in the sessions is confidential." That's a good start. But it's only half the story.

Confidentiality is about what you tell others. You promise your coachee that you won't pass on information from the conversations without permission. That's an agreement in your contract. In the Netherlands, a coach does not have a legal right of non-disclosure like a lawyer or doctor. So your confidentiality rests mainly on what you agree together and on the code of conduct of your professional association, if you're a member of one.

Privacy under the GDPR is about everything you do with personal data. Think of collecting, storing, viewing, sharing, and deleting. Even if you don't pass anything on, you are processing personal data. Your intake form, your calendar, your invoices, and your session notes all fall under it.

Comparison of confidentiality and GDPR privacy

The International Coaching Federation puts it clearly: confidentiality is a right of the coachee, not of the coach. So your coachee also has a say in where the boundaries lie. That's why you agree on those boundaries in advance, on paper, and not only once a difficult situation arises.

Which rules apply in the Netherlands

For coaches in the Netherlands, the main rules are the GDPR and the Dutch GDPR Implementation Act (UAVG). The GDPR is the European privacy law. The UAVG supplements that law with Dutch rules. The Dutch Data Protection Authority (AP) supervises it.

If you work as a self-employed coach with your own practice, you are the data controller. That means you determine why and how you process data, and you are also accountable for it. This applies even if you're small and only have a few coachees.

In addition, codes of conduct play a role. If you're a member of a professional association such as NOBCO or ICF, you have committed to their ethical rules. Those rules are not law, but your coachee may rely on them. It's wise to state in your contract which code of conduct you follow.

Which data you may record, and why

For every purpose for which you use personal data, you need a legal basis. For entrepreneurs, according to the AP, that is usually the performance of an agreement. You need a name, contact details, and payment details to deliver and invoice your coaching track. You don't have to ask for separate consent for that.

Be careful with sensitive information. Coachees often talk about health, burnout, relationships, or faith. These are special categories of personal data. Under the GDPR, much stricter conditions apply to them than to ordinary data. In practice, this means:

  • In your intake, only ask what you genuinely need for the track.
  • In your notes, write down what is relevant for the coaching, not everything you hear.
  • Not sure whether you may record health data, for example in reintegration coaching after illness? Then consult a privacy lawyer or your professional association before you start.

Do you want to ask for consent, for example to record a session or use an anonymized case in peer supervision? Then that consent must be free, clear, well explained, and specific. The AP also notes that pre-ticked boxes are not permitted. So ask separately, per purpose, and let your coachee choose for themselves.

The privacy agreements in your contract, by topic

Below are the topics that come up in a good coaching contract. The sample texts are a starting point. Adapt them to your own practice.

Topic What you arrange Sample text
Confidentiality What is confidential and for whom "The coach keeps everything the coachee tells in the sessions confidential towards third parties."
Exceptions When you may or must share something anyway "This does not apply if the law obliges the coach to provide information, or if there is serious danger to the coachee or another person."
Client What the employer gets to hear "The client receives only information that the coachee has consented to in advance."
Data Which data you record and why "The coach records contact details, appointments, and session notes to carry out the track."
Retention How long and what happens afterwards "After the track ends, the coach keeps the notes no longer than necessary and then deletes them."
Security How you protect data "The coach keeps data in secure software with access via an extra login step."
Peer supervision Consultation with colleagues "When consulting with colleagues, the coach only shares information that cannot be traced back to the coachee."
Rights Access, modification, deletion "The coachee can always ask the coach for access to, correction of, or deletion of their data."

The exceptions are the most important part. Many Dutch coaches use a form similar to this one from the terms and conditions of a coaching practice: information does not go to third parties without consent, except where the law requires it or where it is necessary to prevent harm to the coachee or another person. Name the exceptions concretely. A coachee who knows where the boundary lies will actually dare to say more within that boundary.

Don't want to start from a blank document? With our free coaching agreement generator you create a first version, which you then supplement with the agreements from this article.

Coaching on behalf of an employer

In leadership coaching and career coaching, the employer often pays. Then you have three parties: you, the coachee, and the client. In practice, this is where things most often go wrong. The employer wants to know whether the track is working. The coachee wants to be able to speak freely about doubts, including about that employer.

The NOBCO model for a coaching agreement is clear about this. Conversations with the coachee are strictly confidential and do not go to the client without the coachee's explicit consent. Only where the law or a competent government authority requires it does an exception apply.

Here's how you set it out:

  1. Agree on what you report. For example, only the number of sessions, the start and end dates, and the general goals. Not what was said in the sessions.
  2. Let the coachee read it first. Prepare every report to the client together with your coachee. Only then does it get sent.
  3. Protect your coachee's position. Don't share anything that would put the coachee in a difficult position with the employer, for example about a move to another job.
  4. Hold a three-way conversation at the start. Discuss the agreements with all three parties, so that no one is surprised later.

Put these points in the contract with the client and in the agreements with the coachee. That way you have a text you can refer to if the employer later asks for more. Want to show what progress there is without revealing the content? Then read how reporting while maintaining confidentiality works in practice.

Session notes: what you write down, keep, and secure

Your session notes are often the most sensitive data in your practice. They contain breakthroughs, worries, and personal stories. Yet many contracts say nothing about them.

What you write down. Write factually and briefly. Record what you need to guide the track well: goals, agreements, what stood out to you, and which actions the coachee is taking. Don't write down judgments you wouldn't want to show your coachee. After all, a coachee may access their own data. More tips are in our guide to session notes.

How long you keep it. The GDPR names no fixed term for coaches. The rule is that you keep data no longer than necessary for the purpose for which you collected it. Choose a term you can explain, write it in your contract, and stick to it. Note: a separate tax retention obligation applies to invoices. That stands apart from your session notes. Ask your accountant which term applies to your records.

How you secure it. Notes in a notebook in your bag, loose Word files, or messages in a chat app are hard to secure. You also quickly lose track. Better is a place with a strong password and an extra login step, such as a code on your phone (that's called MFA).

Peer supervision and supervision. Discussing a case with colleagues? Then anonymize the information. Leave out the name, employer, and recognizable details.

Session notes: what you write down, keep, and secure — overview diagram

Software and the data processing agreement

Do you store coachees' data in an online calendar, a booking system, or coaching software? Then that supplier processes personal data on your behalf. According to the AP, you then need a data processing agreement. It sets out what the supplier may do with the data and how they secure it.

Important to know: you remain responsible. Even if the supplier drew up the agreement. So read it carefully and keep it with your records.

For every tool that stores coachees' data, ask:

  • Where is the data kept? Inside the EU or outside it?
  • Is a data processing agreement available?
  • Can I log in with an extra step, such as a code on my phone?
  • Can I fully delete a coachee's data if they ask for it?
  • How many separate tools do I use? Every extra tool is an extra place where data is stored.

How Exantur helps with this

Exantur is coaching software built around the coaching track. Your data is stored in the EU, in Frankfurt. Your practice's data is separated from that of other practices, you log in with MFA, and a data processing agreement is available. Session notes, goals, intake forms, and documents stay with the right coachee. Using the optional AI assistant for session summaries? It works with your own Anthropic key and doesn't send along any data that reveals who your coachee is. The Mini plan costs €19 per month, Starter €49 per month. View all plans and prices and try it for free first.

To be fair: software doesn't automatically make your practice GDPR-proof. The agreements in your contract, your privacy statement, and how you yourself handle data remain your responsibility. Software does make it a lot easier to keep to those agreements.

Your coachee's rights, and what you do with a request

Privacy is more than keeping quiet. Your coachee has rights over their own data. The privacy regulation from Coaching Monitor gives a good overview of what comes into play in a coaching practice:

  • Access: the coachee may see which data you hold about them.
  • Correction: they can have incorrect data adjusted.
  • Deletion: they can ask to have their data erased.
  • Restriction: they can ask to temporarily not use data.
  • Portability: they can obtain their data to take it to someone else.
  • Objection: they can object to a particular use.
  • Complaint: they can file a complaint with the Dutch Data Protection Authority.

A coachee can make such a request by letter or email. You must respond within a month, also by letter or email. Write in your contract how your coachee can reach you for such a request. Also make sure you can find the data quickly. If your notes are scattered across email, chat, and folders, an access request becomes quite a chore.

Your coachee must also know in advance what you do with their data. That can be in the contract or in a separate privacy statement. According to the AP, in it you explain, among other things, which data you use for which purpose, who receives it, how long you keep it, and what rights the coachee has. A short reference in the contract to your privacy statement is sufficient, as long as that statement is complete.

Step-by-step plan: how to put it on paper

  1. Make a list of your data. Which data do you collect at intake, during sessions, and at invoicing? Where is it stored?
  2. Determine the purpose and legal basis for each piece of data. Usually that's the performance of the contract. For extras, such as recordings, you ask for separate consent.
  3. Delete what you don't need. Less data means less risk.
  4. Write your confidentiality clause with concrete exceptions.
  5. Arrange the agreements with the client, if there is one.
  6. Choose a retention term and put it in the contract and privacy statement.
  7. Check your tools and conclude data processing agreements.
  8. Discuss the contract in the first session. Don't just have it signed, but also explain it.

Want to know where you stand now? Go through our GDPR checklist for coaches, or do the short coaching privacy check.

Our perspective: trust begins with the contract

We speak with many coaches who have their confidentiality well arranged in the conversation, but not on paper and not in their tools. The promise "everything stays between us" is sincere. At the same time, the notes are in a shared folder, appointments go via a chat app, and intake forms sit in a mailbox. That's not ill will. It grows that way, tool by tool.

We think privacy in coaching has three layers that must fit together. The first layer is the contract: clear agreements, including about the tricky exceptions and about the employer. The second layer is how you work: what you write down, what you leave out, what you share. The third layer is where your data is stored. If one of those layers isn't right, your promise to the coachee is worth less than you think.

That's why we built Exantur around the coaching relationship, not as a general customer system. Notes, goals, and documents belong to a coachee and a track. They are stored in the EU and are secured. We do say honestly: no tool takes over your responsibility. The contract and the conversation about it remain the foundation.

— Martijn

Frequently asked questions

Is a confidentiality clause enough for the GDPR?

No. A confidentiality clause arranges that you don't pass anything on. The GDPR asks for more: you explain which data you use, why, how long you keep it, and what rights your coachee has. That can be in your contract or in a separate privacy statement.

Do I need to ask permission to take session notes?

Usually not. Notes you need to carry out the track fall under the performance of the agreement. For extras, such as recording a session or using a case in a training course, you do ask for separate and clear consent.

May I tell the employer anything if they pay for the track?

Only what you have agreed in advance and what your coachee consents to. Set out in the contract what you report, for example the number of sessions and the general goals. Let your coachee read every report first before you send it.

How long may I keep a coachee's data?

There is no fixed term for coaches. You keep data no longer than necessary for the purpose. Choose a term you can explain and put it in your contract. For invoices there is a separate tax retention obligation; ask your accountant which term applies to you.

What do I do if a coachee asks to delete their data?

Confirm the request and respond within a month by letter or email. Delete the data from everywhere it is stored, including your email and loose files. Data you are legally required to keep, such as invoices, you may retain; explain that in your reply.

Sources

Recommendations