Guide · Letters

Writing to a client's GP: consent and content

Last reviewed 12 October 2026 · 6 min read

A GP update letter tells a client's GP that therapy has started, how it is going or that it has ended. In private practice the safe default is simple: ask the client, record their explicit consent, and share only what the GP needs. Disclosure without consent is a narrow exception, not a routine.

• DefaultExplicit consent, recorded per letter
• ContentMinimum the GP needs
• LawUK GDPR and common law confidentiality
• ExceptionSerious risk; follow your body's guidance

The legal frame in brief

Information about a client's mental health is special category data under UK GDPR. To share it you need a lawful basis and one of the Article 9 conditions. The ICO describes the health and social care condition, which applies when the information is handled by a professional who owes a duty of confidentiality, and explicit consent, which "must be confirmed in a clear statement" and specify the kind of data involved.

Alongside data protection law, the common law duty of confidentiality applies to you as a therapist. HCPC registrants must "treat information about service users as confidential", and BACP's Ethical Framework treats confidentiality as part of keeping trust. In practice this is why consent is the safe default for letters to a GP, even where a data protection condition might also be available.

This is general information about the framework, not legal advice for your situation.

How to ask for consent

1. At contracting. Explain whether and when you usually write to GPs, and ask for the GP's details only if the client agrees.
2. Before each letter. Tell the client what the letter will say. A short summary of the content is enough.
3. Record it. Date, recipient, purpose and the content agreed. A tick box without a date is weak evidence.
4. Respect a refusal. If the client says no, do not write, and note the decision.
5. Offer a copy. Many clients appreciate seeing the letter before or after it is sent.

What to put in the letter

Keep it short. A GP reads many letters a day; one page with a clear purpose in the opening sentence is easier to act on.

When consent is not the route

There are limited situations in which a therapist may share information without consent, for example where there is a serious risk of harm to the client or someone else. These decisions depend on the facts, your contract and your professional body's guidance. Use supervision, document your reasoning, and share only what is necessary. We do not cover the detail here.

Keep a record of the disclosure

File a copy of the letter in your record together with the consent entry. If the client later asks what was shared, you can show them. Under UK GDPR clients can ask for their personal data, and the controller must respond within the applicable time period, which is normally one month.