DSGVO Consent for Genogram Work (Template)

Why a consent — and why is a contract not enough?

Genogram data are special categories of personal data within the meaning of Art. 9 DSGVO. They comprise health data, information on ethnic origin, religious or philosophical belief, sex life and biographical constellations — in the case of psychologically burdened clients usually spanning several generations. This makes their processing prohibited by default (Art. 9(1)); it becomes permissible only where one of the exceptions of paragraph 2 applies. In freelance counselling this is in practice almost always lit. a — explicit consent.

A counselling contract under §§ 611 et seq. BGB justifies the collection of ordinary data (name, address, fee data) via Art. 6(1)(b) DSGVO. For special categories such as diagnoses, medication, family illnesses or addiction history, this is not sufficient. Here a second, separate, explicit consent is required — in writing or electronically, granular by purpose of processing, freely revocable.

Three reasons why a properly documented consent is existential: First, legally — without valid consent, collection and storage are unlawful (Art. 5(1)(a), Art. 9, Art. 7 DSGVO). The supervisory authorities impose fines of up to EUR 20 million or 4% of annual turnover (Art. 83(5)). Second, in civil law — clients can claim non-material damages under Art. 82 DSGVO; the German Federal Court of Justice (BGH) confirmed in 2024 that mere "loss of control" over data is sufficient (BGH VI ZR 10/24). Third, professionally — for licensed therapists the DSGVO obligation is additionally a professional-law duty; for independent counsellors it is the most severe compliance risk, one that is practically barely insurable.

Genogram-specific problem: The client collects data about third parties (parents, grandparents, siblings, partners, possibly third parties' children). These persons cannot themselves consent — and the "household exemption" (Art. 2(2)(c)) does not apply to professional processing. The DSK (Datenschutzkonferenz, the German data protection conference of supervisory authorities) resolves this pragmatically: the client must be informed that they report from their own recollection; the third-party information is processed exclusively within the therapeutic context between client and counsellor, is not passed on externally, and is stored for as short a time as possible. This special case belongs in every consent declaration as its own clause.

Contents: Art. 6 legal basis · Art. 7 conditions for consent · Art. 9 special categories · Art. 13/14 information obligations · Art. 30 record · mandatory clauses · pitfalls · FAQ · printing-notice cover · fillable consent declaration · adaptation checklist · sources.

Art. 6 DSGVO — Lawfulness of processing

Plain-language explanation. Art. 6 is the entry hurdle for any data processing. In counselling practice only three grounds are relevant: lit. a (consent) as the default for independent counsellors, lit. b (performance of a contract) for fee data and contact details arising from the counselling contract, lit. c (legal obligation) for the ten-year retention of invoices under § 147 AO. Genogram content does not fall under lit. b — even though the counselling itself is the subject of the contract, the actual collection of sensitive family data is a separate processing operation.

What must go into the consent? A clear statement of which legal basis applies to which data category. Catch-all wording ("data necessary for the counselling") is, according to BfDI practice, insufficient. Separate: §1 contract data (lit. b), §2 genogram content (lit. a + Art. 9 lit. a), §3 invoice archive (lit. c).

Art. 7 DSGVO — Conditions for consent

Plain-language explanation. Art. 7 is the quality control of the consent. Four obligations: obligation to demonstrate (para. 1 — the original signed form must be locatable at any time), obligation of separation (para. 2 — consent must not be lost within the contract text, hence a separate document), notice of withdrawal (para. 3 — the client must be informed in advance of the right of withdrawal, otherwise the consent is invalid), voluntariness / prohibition of tying (para. 4 — counselling must not be made conditional on consent to non-necessary processing).

What must go into the consent? A separate document (not part of the counselling contract), signed before any data collection, with an explicit notice of withdrawal. Each granular consent (record keeping, supervision, audio recording, information to the general practitioner) gets its own checkbox. The client must be able to choose for each box without otherwise being refused counselling.

Art. 9 DSGVO — Special categories (the heart of genogram work)

Plain-language explanation. Art. 9 is the special rule for sensitive data — and genogram content practically always falls under it. Ethnic origin (questions of migration, "family roots"), religious beliefs (church affiliation, conversions), health data (illnesses, psychological diagnoses, addiction history), data concerning sex life (sexual orientation, patterns of infidelity) — all of this can appear in a genogram, and as soon as one of these categories is touched, Art. 9 applies to the entire data set of that person.

The threshold for "explicit" (para. 2 lit. a) is higher than for ordinary consent: not merely a "clear affirmative act" as under Art. 6 lit. a, but an explicit yes to this specific category. Implied consent (through telling) is not sufficient.

What must go into the consent? Per category (health, origin, religion, sex life, possibly genetic data in the case of family illnesses) an own checkbox with a concrete purpose of processing. Example: "☐ I consent to the collection of health data (my own and family illnesses) for the purpose of creating the genogram." — separate from "☐ I consent to the collection of data on ethnic origin (the family's migration history)."

Art. 13 / 14 DSGVO — Information obligations

Plain-language explanation. Art. 13/14 are the transparency obligations that precede the consent. A valid consent presupposes that the client knows beforehand what happens. Infringements are more frequent and more expensive than infringements of Art. 7 — supervisory authorities routinely check whether the information is complete.

In practice: The information sheet under Art. 13 is a separate document that is handed over before the consent declaration and co-signed ("I have received and read the data protection information"). In practice: a double document — page 1 information sheet, page 2 consent with granular checkboxes.

Genogram-specific case Art. 14: When the client reports data about third parties (grandmother, deceased uncle), this data is collected from third parties. Strict reading: the persons named would have to be informed within one month. In counselling practice this is absurd — the DSK accepts a reduction to what is necessary (data minimisation) and non-disclosure. Nevertheless, include in writing in the consent that third-party information is used exclusively for the counselling.

Art. 30 DSGVO — Record of processing activities

Plain-language explanation. Art. 30 is the obligation to document one's own processing — and the exception reservation in para. 5 practically never applies to counselling practices: genogram data are Art. 9 data and are processed regularly (not only occasionally). The record of processing activities is therefore mandatory for every counselling practice — including the independent solo practice.

Contents: per processing purpose (1. counselling, 2. fee accounting, 3. possibly supervision, 4. possibly advertising) a data sheet. The supervisory authorities can request the record at any time; delay or absence is sanctioned as a separate infringement.

What must go into the consent? Actually nothing — the record is internal. But: the processing purposes and storage periods promised in the consent must be consistent with the record. Supervisory authorities check precisely this alignment. A model template in this PDF on the last explanatory page — a minimum record to self-complete.

Mandatory clauses of the consent declaration (checklist)

The following list is the consolidated mandatory list from the BfDI model text, the BPtK practice information on data protection 2018, and DSK resolutions. If one of the categories is missing, the consent is regularly considered invalid in the event of a dispute:

1. Identity of the controller — name, address, telephone, e-mail
2. Data protection officer (if any) — contact
3. Purposes of processing — concrete, separated per data category
4. Legal basis — name Art. 6 + Art. 9 explicitly
5. Categories of collected data — mark Art. 9 explicitly
6. Recipients / categories of recipients — tax advisor, IT service provider with data processing agreement, supervisor
7. Third-country transfer — as a rule "no" in the case of local/EU storage
8. Storage period — concrete (10 years invoice, X years counselling documentation)
9. Data subject rights — access, rectification, erasure, restriction, objection, data portability
10. Right of withdrawal — at any time for the future, without formality
11. Right to complain — to the competent state supervisory authority, named
12. Notice of voluntariness — consequences of non-consent
13. Notice of automated decision-making — as a rule "no"
14. Date + signature client + where applicable persons with custody
15. Granular checkboxes — individually per processing purpose
16. Genogram-specific clause — third-party information (family members) exclusively for the counselling

Three special cases in counselling practice

Minors

Children under 16 years (DSGVO standard; individual federal states have set it lower, in Germany 16) cannot themselves give valid consent — consent of all persons with custody is required. From around 14 years of age, an age-appropriate additional explanation to the child is a professional-ethics standard (BPtK, DGSF). In the case of separated parents: both persons with custody sign, even if only one person attends. In the case of sole custody: proof (court order) in the file.

Audio and video recordings

Recordings are a separate, distinct processing activity with additional risk (image rights under § 22 KunstUrhG, voice as a biometric datum). Separate consent with its own statement of purpose (teaching, self-reflection, supervision), its own storage period and a reservation of erasure after the purpose ends. Never as a "tick under the main consent" — its own form.

Supervision and intervision

Even anonymised case discussions are a disclosure of data (to the supervisor). Where this falls under § 203 StGB (licensed therapist), the reference to the confidentiality obligation suffices. In the case of independent supervision without § 203: obtain a contractual confidentiality undertaking from the supervisor and name them by name as a category of recipient in the consent, or at least mark them as a "professionally confidential supervisor".

FAQ — Six central client questions

Adaptation checklist before practical use

Before use in client contact, all points should be clarified with a specialist lawyer for data protection law:

☐ Responsible body (name, address, contact) entered
☐ Data protection officer specified (if required under § 38 BDSG)
☐ Concrete storage periods inserted — no "X years" placeholder
☐ Professional-standard period for counselling documentation checked (3 vs. 10 years)
☐ Recipient list (tax advisor, IT, supervisor) concrete + data-processing-agreement status
☐ State data protection authority named (each federal state has its own)
☐ Granularity: each data category individually tickable (Art. 9)
☐ Third-party information clause (genogram special case) built in
☐ Notice of withdrawal placed BEFORE signature, without tying
☐ Information sheet Art. 13 prepared as a separate document
☐ Record of processing activities pursuant to Art. 30 set up + consistent with the consent
☐ For online sessions: platform + server location + Schrems II status
☐ For audio recordings: separate consent with its own purpose
☐ For minors: all persons with custody + age-appropriate explanation
☐ For supervision without § 203: confidentiality obligation of the supervisor contractually
☐ Data breach response plan (72-hour notification Art. 33) in place
☐ Hard-drive encryption + 2FA technically implemented
☐ Original consent archived securely and locatably (obligation to demonstrate)
☐ Contract text reviewed by a specialist lawyer for data protection law

Sources and further reading

• DSGVO Art. 5, 6, 7, 9, 13, 14, 28, 30, 33, 34, 82, 83 — full texts at dsgvo-gesetz.de.
• § 203 StGB — confidentiality obligation protected under criminal law (linked to Art. 9(2)(h)).
• § 147 AO — 10-year retention obligation for accounting documents.
• § 38 BDSG — obligation to appoint a data protection officer.
• BfDI — Basic knowledge on consent (bfdi.bund.de) — Federal Commissioner for Data Protection and Freedom of Information, model texts.
• Datenschutzkonferenz (DSK) (datenschutzkonferenz.de) — resolutions and guidance of the supervisory authorities, in particular on the processing of special data categories.
• BPtK — Model data protection declaration for psychotherapists + BPtK practice information on data protection 2018 (bptk.de) — German Federal Chamber of Psychotherapists.
• Chamber of Psychotherapists Berlin — Data protection in psychotherapeutic practice (2018, detailed practice guide).
• DGVT — Data protection law for psychotherapeutic practices (dgvt.de).
• LPK Rhineland-Palatinate — Data protection FAQ (lpk-rlp.de).
• KV Baden-Württemberg — Data protection & confidentiality obligation (kvbawue.de).
• PTK NRW — Law / data protection (ptk-nrw.de).
• Professional Association of Data Protection Officers of Germany (BvD) — Data Protection Wiki (datenschutz-wiki.de) — background.
• BGH VI ZR 10/24 (2024) — non-material damages for loss of control under Art. 82 DSGVO.

For every clause: legal review before productive adoption. Laws, case law and supervisory practice change — this template is a snapshot as of 2026-06-03.