Exit counselling means to facilitate deradicalisation and personal growth, so that clients distance themselves from anti-democratic and violent-extremist thinking and behaviour. Exit counselling therefore implies intensive work with most sensitive personal and family/community issues – sometimes resembling psychotherapy; it thus requires voluntary participation, confidentiality and the processing of personally-identifiable data. Yet, by working in an inter-agency scenario, exit practitioners are often asked to report and/or give risk-assessments about clients. Besides, data protection issues around exit programs are often misunderstood as conflict between individual rights and state security interests, with the consequence of disregarding the vulnerability of both the clients and democracy itself and its quintessential separation of powers/functions. Although the GDPR does not explicitly define vulnerable data subjects, clients should be protected because of the higher risks of damages arising to data processing and/or to the outcomes of such processing.

• How to define vulnerable data subjects in exit counseling, within the data protection framework?
• How is the right to data protection of clients ensured in the inter-agency setting of exit programs?
• To what extent is the professional secrecy of exit practitioners limited by security concerns, having special regard to the right not to testify in court?
• Are there alternatives to further balance the vulnerability of clients and the professional secrecy of exit workers against security concerns?