Secure messaging in coaching: how to share information safely
Secure messaging in coaching: how to share information safely
Secure messages in coaching are messages that only you and your coachee can read. They sit in a place where you are in control, and you know who else can access them. That sounds simple. In practice, contact with coachees often runs through a mix of WhatsApp, regular email and loose attachments. In this article you will read what the GDPR requires of you and which messages really need extra protection. You will also see how to compare channels and how to get your messaging in order in a few steps.
In short
- The GDPR does not prohibit email or chat, but as a coach you have to provide appropriate security yourself. What is appropriate depends on how sensitive the information is.
- Not every message is equally sensitive. Rescheduling an appointment is something different from a reflection about burnout, conflicts at work or a home situation.
- With a tool, pay attention to three things: encryption, where the data is stored, and whether you get a data processing agreement.
- Keep sensitive content out of chat apps and mailboxes as much as possible. Put it in a fixed, protected place that belongs to the right coachee.
- If something does go wrong, report a data breach to the Dutch Data Protection Authority within 72 hours.
Table of contents
- Why messages in coaching need extra attention
- What the GDPR requires of you
- What are encrypted messages?
- Which messages need extra protection
- Common channels side by side
- Five questions before you choose a tool
- How to set up secure messaging
- If something does go wrong
- Our view: take the content out of the chat
- How Exantur helps you with this
- Frequently asked questions
- Sources
Why messages in coaching need extra attention
A coaching engagement is built on trust. Your coachee tells you things they do not share with a manager, colleague or partner. Much of that information comes up not only in the session itself, but also in the messages in between. Think of:
- a short update after a difficult conversation with a manager;
- a completed reflection form or a Wheel of Life;
- a check-in about how sleep, stress or motivation is going;
- a CV, a performance review or a 360-degree feedback report;
- a voice message on an evening when things are not going well.
Such messages often say more about someone than a session report. And they sit in places where you, as a coach, have little oversight: in a chat history on your phone, in a shared mailbox, or in a folder of downloads. That is precisely where most of the risks arise. Think of a phone you lose, an email that goes to the wrong recipient, or an attachment that stays for years in a mailbox your bookkeeper can also access.
In executive coaching and career coaching there is another factor at play. Often an employer pays for the engagement. Your coachee wants to be sure that what they write to you does not end up with that employer. Secure messaging is therefore not only a legal matter, but also part of your professional promise.
What the GDPR requires of you
The GDPR is the General Data Protection Regulation, the European privacy law. As soon as you store or share names, contact details, notes or other information about coachees, you are processing personal data. Then the GDPR applies to you.
The Dutch Data Protection Authority (AP) is clear about this. You must take appropriate technical and organisational measures to secure personal data. You determine what is appropriate yourself with a risk analysis. In doing so, you look at the nature, the amount and the sensitivity of the data. Technically, it is about things like encryption and strong passwords. Organisationally, it is about agreements: who may view what, how long you keep something, and what you do if it goes wrong.
Two points are important for coaches:
- Email is not prohibited. You may email with coachees. But you are responsible for the security. According to the AP, you can for example encrypt attachments or use a secure email server. Often there are also safer ways to exchange data than regular email.
- Sensitive information requires more. Information about health falls under special categories of personal data. For that, a higher level of security applies than for a phone number. For healthcare providers, the AP names specific standards such as NEN 7510. As a coach you are usually not a healthcare provider. But if a coachee talks to you about burnout or medication, they are sharing health information. That is a reason to be extra careful.
Do you work with coachees who are being treated by a psychologist or GP? Or are you unsure whether your work falls under healthcare? Then put that to a privacy lawyer or your professional association. The same applies if you make agreements with an employer about what you do and do not report back.
What are encrypted messages?
An encrypted message is a message that is converted into unreadable code while in transit and in storage. Only those who have the right key can read it again. There are roughly two forms:
- Encryption in transit. The message is protected between your device and the provider's server. On the server itself, the provider can in principle read it. This is how much regular email works.
- End-to-end encryption. The message becomes readable again only on the recipient's device. The keys are only on the users' devices, not with the provider. The European Union Agency for Cybersecurity, ENISA, recommends tools with end-to-end encryption for professional use.
Encryption is important, but it is not the whole story. Three things remain important even with an encrypted app:
- Metadata. Even if the content is encrypted, an app can record who you are in contact with, when, and how often. In a coaching relationship that already says a lot.
- Where the data is stored. ENISA advises preferably hosting tools within the European Union. Data outside the EU does not always fall under the same protection.
- The device itself. An encrypted chat on a phone without a PIN is as open as a notebook on the table. And if your coachee forwards a chat or takes a screenshot, encryption no longer helps either.
Which messages need extra protection
You do not have to treat every message as a state secret. A good risk analysis starts with an honest categorisation. The table below helps you with that.
| Type of message | Example | Sensitivity | Better channel |
|---|---|---|---|
| Practical | Confirming an appointment, the session address, a reminder | Low | Email or an automatic reminder |
| Substantive work | Assignment, exercise, preparation for a session | Medium | A protected place that belongs to the coachee |
| Personal reflection | Check-in about stress, relationship, doubts about the job | High | Protected place, never in an open group chat |
| Documents with assessments | Assessment, 360-degree feedback, performance review | High | Protected place with clear access rights |
| Health | Burnout, medication, diagnosis | Very high | As little as possible in writing, and then only well secured |
A rule of thumb: the more a message says about someone's inner world, health or position at work, the less it belongs in a regular chat or mailbox.
Common channels side by side
In practice, coaches use a mix of channels. Each channel has its own strengths and weaknesses.
| Channel | Strength | Watch out |
|---|---|---|
| Regular email | Everyone has it, easy for appointments | Often only encrypted in transit, attachments stay in mailboxes for a long time, risk of a wrong recipient |
| Encrypted email | Content and attachments better protected | The recipient sometimes has to take an extra step, messages are still separate from the engagement |
| Consumer chat apps | Fast and familiar for coachees | Mixed with personal contacts, metadata, storage outside your control, hard to keep or delete per engagement |
| A protected coachee portal | Information sits with the right coachee and the right engagement, you decide on access | The coachee has to log in, less suitable for a quick "I'll be five minutes late" |
Chat is not prohibited, but you have to be very deliberate about what you share in it. A safe practice usually works with two layers: a quick channel for practical matters and a protected place for everything that concerns the content.
Five questions before you choose a tool
Are you choosing an email service, a chat app or coaching software? Then ask yourself these questions. They are based on ENISA's tips and the AP's requirements.
- Is the content encrypted? Ask whether messages and files are encrypted in transit and in storage. For chat, end-to-end encryption is the best choice.
- Where is the data stored? Preferably choose a service that keeps the data within the EU. Ask about it if it is not clearly stated on the website.
- Does the provider use your data for anything else? ENISA advises tools that do not share data for marketing. Check the privacy terms for this.
- Do you get a data processing agreement? If a supplier stores data on your behalf, that supplier is a processor. Then, according to the AP, you need a written data processing agreement. It states what the supplier does with the data and what happens in the event of a data breach.
- How well is access secured? Ask about MFA. That stands for multi-factor authentication: in addition to your password, you confirm the login with a code on your phone. A stolen password is then not enough to get in.
Want to see where your practice stands in a few minutes? Take the privacy check for coaches or go through the GDPR checklist for coaches.
How to set up secure messaging
You do not have to change everything at once. With these steps you bring order in a few weeks.
- Make a list of your channels. Write down the ways coachees currently send you messages: email, chat, text message, shared folders, forms. Often there are more than you think.
- Categorise your messages. Use the table above. Which messages are practical and which concern the content of the engagement?
- Choose a fixed channel per type. For example: appointments via email or automatic reminders, and reflections, assignments and documents in a protected place.
- Record it in your coaching agreement. Write down how you communicate, what you do not discuss via chat, and how quickly you respond. You can draw up a coaching agreement with a free template.
- Tell your coachee in the first session. Briefly explain why you do not want to discuss sensitive matters via chat. Most coachees actually find that professional.
- Secure your own devices. Put a PIN on your phone, use MFA where possible, and keep work and personal contacts as separate as possible.
- Clean up. Agree on how long you keep messages and documents. Delete old chats and attachments once an engagement has ended and you no longer need them.
- Review once a year. Tools change and your practice grows. With a short annual check, your security stays appropriate.
If something does go wrong
An email to the wrong recipient, a stolen laptop or a hacked account: even if you are well prepared, something can go wrong. The AP gives tips to prevent a data breach and be prepared. It helps to know in advance what you will do.
According to the AP, you report a data breach within 72 hours after you discover it. As a coach you are the data controller: the one who determines why and how data is used. That is why you have to report the breach, even if it happens at your software supplier. You can have the supplier report it on your behalf, but that must then be recorded in writing.
A practical emergency plan fits on a single A4:
- who you call if you suspect a breach;
- how you block access, for example by changing passwords or wiping a device remotely;
- how you determine whether you must report to the AP and whether you must inform the coachee;
- where you record the incident, even if you ultimately do not have to report it.
Are you unsure whether an incident must be reported? Then contact a privacy lawyer or your professional association. Do not wait until the 72 hours are nearly up.
Our view: take the content out of the chat
We speak with many coaches who want to get their practice well organised. Almost all of them recognise the same picture. The conversation in the session is well protected: a quiet room or a closed video call. But everything around it is scattered. A reflection in WhatsApp, an assessment as an attachment in the email, action points in a spreadsheet.
Our point is simple. The question is not only which app encrypts best. The question is where the content of a coaching engagement should be stored. We believe: with the coachee and the engagement, in a place where you decide on access. A quick channel for practical matters remains perfectly fine. But check-ins, preparations, assignments and documents do not belong between birthday wishes and group photos.
On top of that, encryption does not solve everything. With a secure tool, your practice does not automatically comply with the GDPR. You remain responsible yourself for your agreements, your risk analysis and your choices. Software can help you well with this, but the thinking remains yours. We also say this honestly to coaches who work with Exantur.
Martijn
How Exantur helps you with this
Exantur is software for coaches who want to run their practice in a cohesive workspace. For secure contact with coachees, the coachee portal is especially important. In it your coachee completes check-ins, prepares for sessions and sees goals and progress. Shared documents, assignments and courses are also there. That way the content of the engagement is no longer in chats and mailboxes, but with the right coachee. You also track accountability there: you keep an eye on whether your coachee does what they have agreed.
For privacy, Exantur has a number of standard measures:
- data is stored in the EU, in Frankfurt;
- your practice's data is shielded from that of other practices;
- login is possible with MFA;
- a data processing agreement is available.
You can read more about this on the page about security at Exantur. You handle practical messages with online booking and automatic session reminders. Those then do not have to go via separate emails.
The Mini plan costs €19 per month or €190 per year. The Starter plan costs €49 per month or €490 per year. You can try Exantur for free first. View all plans and prices.
Frequently asked questions
Can I use WhatsApp with coachees as a coach?
Yes, the GDPR does not prohibit it. But you are responsible for appropriate security yourself. Preferably use it for practical matters. Keep sensitive content, such as reflections and documents, in a protected place.
What exactly are encrypted messages?
These are messages that are converted into unreadable code, so that only those who have the key can read them. With end-to-end encryption, only the sender and the recipient can read the message, not the provider. Also pay attention to where the data is stored and who can access it.
Do I have to secure my email when I correspond with coachees?
You have to provide security that fits what you share. For an appointment, regular email is often enough. For sensitive documents, you can encrypt attachments or use a secure email service. You can also place the information in a protected location instead of emailing it.
Do I need a data processing agreement with my software?
Yes, if a supplier stores or processes your coachees' personal data on your behalf. According to the AP, you then record in writing what the supplier does with the data and what happens in the event of a data breach. Always ask about this before you start using a tool.
Sources
- Step 4: Get your security in order, Dutch Data Protection Authority
- Securing health data, Dutch Data Protection Authority
- How to report a data breach, Dutch Data Protection Authority
- Preventing a data breach and being prepared, Dutch Data Protection Authority
- Tips for selecting and using online communication tools, ENISA