Coaches & Mentors
I'm just a coach, not a therapist." That is not a defence under data protection law.
The law applies to the data — not the job title. If your clients talk to you about their mental health, relationships, health, or personal struggles, you are handling some of the most legally sensitive data that exists. This guide tells you what that means for how you use AI tools in your practice.
Coaching is unregulated. Data protection is not
There is no law that says you must be qualified to coach. There is also no exemption from UK GDPR because you are small, solo, or self-trained. If you take money from clients, hold information about them, and use digital tools in your practice — you are a data controller with enforceable legal obligations.
Most coaches are using AI tools with client session content right now, without the account type, the consent, or the documentation required to do that lawfully. This guide covers what you need — specifically, and without the legal jargon.
Three Assumptions Coaches make, that Create Real Legal Exposure
"ChatGPT is private. Nobody sees what I type."
That is not how data processing law works
When you paste client session notes into a free AI account, you are transferring personal data — potentially Special Category Data — to a third-party server. The question is not whether anyone is reading it. The question is whether you have the legal right to transfer it at all.
"I covered it in my terms and conditions."
Consent buried in T&Cs is not valid consent
UK GDPR requires consent to be freely given, specific, informed, and unambiguous. For sensitive personal data — the kind most coaching clients disclose — it must also be explicit and in writing. A clause in your standard terms does not meet this standard.
"The AI tool says it's GDPR compliant."
Their compliance is not your compliance
A platform being GDPR compliant means it operates lawfully as a business. It does not mean you are using it lawfully. You are the data controller. Your obligations — consent, lawful basis, DPA, transparency — exist regardless of what the platform says about itself.
What is in This Guide
Part 1 & 2-Why coaching data is more sensitive than most coaches realise
The guide opens with the specific reason coaching is a higher-risk profession than it appears — and what that means practically for the AI tools you use every day. It does not require you to become a data protection expert. It requires you to understand the three things about your data that are different from most other small businesses.
Part 3- The AI tools coaches use — and what each one requires
A practical section covering the AI use cases most coaches encounter: session notes, transcription, programme planning, client communications, and marketing. For each, the guide tells you what account type, what consent, and what documentation is needed — and flags where the line is.
Part 4 & 5- The two documents every coaching client needs to sign
A Privacy Notice template written for coaching practice. Two consent forms — one for standard client data, one for sensitive disclosures processed through AI tools. These are not interchangeable. The guide explains why, and the forms are ready to adapt and use.
Part 6 onwards -The records that demonstrate you are operating lawfully
An AI Tool Register. A Client Record and Consent Log. A retention schedule — two years for session notes, six for financials. A 72-hour breach response plan. A self-audit checklist that tells you whether your current practice has gaps. And a completed worked example so you can see what compliant looks like in practice.
What you Get
Coaching-specific compliance framework — why your data obligations are higher than most sole traders, and what to do about it
Privacy Notice template — drafted for coaching practice, covering AI tool disclosures and the sensitivity of session content
Two consent forms — general data consent and explicit consent for sensitive data processed through AI tools
AI Tool Register and Client Record Log — the accountability records the ICO expects you to be able to produce
Self-audit checklist — identifies where your current practice has compliance gaps, and what to address first
72-hour breach response plan — what to do if something goes wrong with an AI tool that has processed client data
AI Safe Starter Pack — the foundational seven documents, included free with this guide
Coach & Mentor Action Guide — £47
The profession-specific guide with completed examples, explicit session note consent, retention policy, and a week-one action plan focused on the highest-risk gaps in coaching practice.
Recommended Pathways
Platform DPA Checkers Vol 1 & 2 - £29
Fourteen platforms verified against official sources, April 2026. Includes the scheduling, transcription, and AI tools most coaches use. DPA status, minimum account required, and key findings for each.
Compliance Bundle — £119
Everything in Tier 1 plus the Legal Pack and Companion Guide — recommended for coaches who regularly use AI tools with client data and want a fully documented, legally defensible position.
Full suite — £189
Everything in the Compliance Bundle, plus, the website compliance pack, the Risk & Data pack, DPAs Volume 1&2 recommended for coaches who regularly use booking platforms to schedule calls, who has a website. Everything yon need to be compliant (Please see Full suite on the product page for more details