Confidentiality Release: Why It Matters

What is a release from confidentiality?

A release from confidentiality is a declaration in which a person allows a professional bound by secrecy – such as a doctor, lawyer or therapist – to share specific confidential information with specific third parties. Without this permission or a statutory authorisation, the professional commits a criminal offence under Section 203 of the German Criminal Code (StGB). It is advisable to document the release in writing and to state clearly who may receive which information, for what purpose and for how long.

A release from confidentiality is more than just a signed form – it is the foundation of trust between professionals and their clients or patients. Whether you protect health data as a doctor, safeguard communication with clients as a lawyer or keep session notes as a therapist: you need to know when and how you may lawfully share sensitive information. This article therefore covers the duty of confidentiality, the details every release must contain and how to align your practice with the General Data Protection Regulation (GDPR).

A release from confidentiality defines:

• who may receive the information,
• which data may be shared,
• what the disclosure is for,
• how long the release is valid.

When you put these boundaries in writing, both sides know their rights and obligations – which is essential for trust.

Which laws govern the duty of confidentiality?

In Germany, the duty of confidentiality is based on several sources:

• Section 203 StGB (violation of private secrets): Doctors, psychologists, lawyers, tax advisors, social workers and other professions commit a criminal offence if they disclose secrets entrusted to them without authorisation.
• Professional law: Professional codes specify the duty, for example Section 43a(2) of the Federal Lawyers’ Act (BRAO) for lawyers and the (model) professional code for physicians.
• Section 53 of the Code of Criminal Procedure (right to refuse testimony): Professionals bound by secrecy, such as doctors and lawyers, may in principle refuse to testify about what was entrusted to them. Once they have been released from the duty of confidentiality, they may no longer refuse to testify (Section 53(2) sentence 1 StPO).
• GDPR: Independently of criminal law, every disclosure of personal data requires a legal basis (see below).

What happens if the duty of confidentiality is breached?

A breach of confidentiality can have serious consequences for the professional as well as for the person concerned. Under Section 203(1) StGB, it is punishable by imprisonment of up to one year or a fine; anyone acting for payment or with the intent to enrich themselves or cause harm faces up to two years’ imprisonment or a fine under Section 203(6) StGB. In addition, there may be professional sanctions, claims for damages and sanctions under data protection law. Last but not least, trust in the entire profession suffers.

When do you need a release from confidentiality?

Professionals are generally bound by a strict duty of confidentiality. A release is required whenever information is to be passed on to third parties and there is no statutory authorisation. Typical cases:

Insurers and authorities

Insurers often request medical reports, for example for life, disability or health insurance. For this, they usually need a release from confidentiality signed by the insured person.

Court proceedings

In court proceedings, courts or parties may request documents and testimony. With a signed release, sensitive records (e.g. medical files or notes from legal advice) can be disclosed without breaching professional secrecy.

Coordination between professionals

A release may also be needed for exchanges between treating doctors, therapists or clinics. Whether consent clearly follows from the circumstances must be assessed case by case.

When may professionals share information without a release?

In certain exceptional cases, the law permits or requires disclosure even without the consent of the person concerned:

• Necessity as justification (Section 34 StGB): In the event of a present danger to life, limb or another legal interest that cannot be averted otherwise, for example a risk of self-harm or harm to others, disclosure can be justified if the protected interest substantially outweighs the interest affected and disclosure is an appropriate means.
• Statutory reporting obligations: For example, notifications of certain communicable diseases under Section 6 of the German Infection Protection Act (IfSG).

In these cases, the statutory authorisation replaces the release. However, the professional should document exactly why and to what extent information was shared. As for the duty to report certain planned serious crimes (Section 138 StGB), Section 139(3) StGB provides exceptions for, among others, doctors, lawyers and psychotherapists regarding what was entrusted to them in that capacity; the scope must be assessed case by case.

What must an effective release from confidentiality contain?

A release from confidentiality should contain the following:

1. Details of the parties
   • The person granting the release (e.g. “Patient: Anna Müller”)
   • The professional released and the recipient (e.g. “Released: Dr Thomas Weber; recipient: Munich I Regional Court”)
2. Purpose of the disclosure
   • State clearly what the data will be used for: “For use in the ongoing court proceedings” or “To coordinate psychiatric treatment”.
3. Scope of the information
   • Specify the documents or period: “Medical history from January 2024 to June 2026”, “billing records” or “therapy session notes”.
4. Duration and revocation
   • Set a period of validity (e.g. “valid until 31 December 2027”).
   • Explain that the person can revoke the release. For the data protection consent, Art. 7(3) GDPR applies: withdrawal is possible at any time, and processing carried out until then remains lawful.
5. Data security requirements
   • Describe how the data will be transmitted and protected (e.g. encrypted transmission, secure storage).
6. Signature and date
   • Signature and date of the person granting the release
   • For minors or persons under legal guardianship, the signature of the legal representative where applicable

Release from confidentiality and the GDPR

A release from confidentiality lifts the criminal-law duty of confidentiality under Section 203 StGB. Under the GDPR, disclosing personal data also requires a legal basis (Art. 6 GDPR), and for health data an exception under Art. 9(2) GDPR – for example explicit consent (point a). You can combine the release and the data protection consent in one form. The form must then meet the requirements of both areas, and under Art. 7(2) GDPR the consent must be clearly distinguishable from other matters. Whether the disclosure can be based on consent in a given case, or another legal basis applies, should be reviewed legally.

• Valid consent: Consent must be freely given, specific, informed and unambiguous (Art. 4(11) GDPR).
• Documentation: Record when, to whom and why you disclosed data, and set a retention period for the declaration. You must be able to demonstrate that consent was given (Art. 7(1) GDPR).
• Right of withdrawal: Data subjects can withdraw their consent at any time (Art. 7(3) GDPR). The lawfulness of processing carried out until then remains unaffected; you must stop further disclosures that rely on the consent.
• Transfers abroad: If the recipient is located outside the EEA (e.g. an international law firm) and there is no adequacy decision, you need appropriate safeguards (Art. 46 GDPR), such as standard contractual clauses or binding corporate rules.

Best practices and practical tips

• Use clear forms: Avoid legal jargon. A short one-page summary helps people understand the form at a glance.
• Use digital signatures: Electronic consent solutions simplify collection and make it traceable who granted a release and when.
• Train your team: All employees who handle releases should know their data protection obligations and the procedures for secure transmission.
• Review regularly: Check the records of disclosures regularly to detect breaches and unauthorised disclosures early.

Conclusion

A well-drafted release from confidentiality combines professional ethics with legal requirements. It preserves trust by setting transparent rules for when and how sensitive information may be shared. If you also design the release to be GDPR-compliant – with informed consent (explicit for health data), secure transmission and a clear option to withdraw – you protect privacy while meeting legitimate disclosure requirements.

Want to set up consents, releases and data disclosures in your practice or law firm on a solid footing? With heyData’s external data protection officer, you get templates, training for your team and traceable documentation.

Take the first step: Book a free demo now