How Long to Keep Client Records in the UK: Retention and Disposal

For an adult client, a practical retention period is 7 years after therapy ends; for someone who was under 18, keep the records until 7 years after their 18th birthday. That gives you a clear starting point when deciding how long to keep client records in the UK, but you also need a lawful reason to keep them longer. UK Government data protection rules say personal data must remain identifiable no longer than necessary for the purpose it was collected.

It’s understandable to want a simple answer to how long to keep client records in the UK, especially when case notes sit alongside letters, reports and documents from other people. Set a retention period that fits each record and your practice, explain it to clients, and dispose of records securely when they’re no longer needed.

This guide explains how to set a practical retention schedule, handle third-party documents, and decide when deletion or anonymisation may be appropriate. It also covers how to make secure destruction part of your routine, rather than a task that keeps slipping down the list.

Retention periods based on administrative and legislative needs

There isn’t one retention period that applies to every file. Set each period according to the record’s purpose, any relevant requirements and the event that starts the retention clock.

Recording retention periods

A retention period is how long you plan to keep a record before reviewing or disposing of it. Record it in your record of processing, alongside the purpose and the event that starts the period. For example, you might review a case file when work ends, while a financial record may follow the relevant company year. Note any specific reason for keeping a record longer.

Personal data retention

Personal data retention means keeping identifiable information only as long as its purpose requires. UK Government data protection rules say personal data must not remain identifiable longer than necessary for its processing purpose. I’d review sensitive personal data when that purpose changes or ends, and record the reason if it still needs to be kept.

Destroying records too early can leave you without useful evidence if a complaint or legal issue arises. The risk depends on the record and circumstances, so make sure your schedule reflects the duties that apply to your practice.

Case and project personal data

Case and project personal data is identifiable information gathered for specific work. Set its retention period by considering the work’s purpose, relevant requirements and when the case or project concludes. If a complaint or another ongoing matter affects disposal, document why the file remains necessary and set a review point. This gives you a clear reason for retaining it, rather than letting it remain in storage indefinitely.

Patient record retention

Patient record retention is the period a healthcare provider keeps clinical information. I’d treat healthcare schedules separately, because each UK country sets minimum periods by record type. Adult NHS health records have a minimum of eight years in England and six years in Scotland. In England and Wales, mental health records are retained for 20 years or 10 years after the patient’s death. The start point depends on the category, such as the last entry, treatment ending or death. Longer retention may sometimes be needed.

Secure destruction of records

Secure disposal means making paper and digital records unreadable or inaccessible when their retention period ends. Plan for every format, including copies held by a storage provider.

Third-party storage and destruction

Third-party destruction is when an organisation outside your practice securely disposes of records. If files are stored elsewhere, agree how they will be returned or destroyed when the arrangement ends. Ask for written confirmation of destruction and keep it with your disposal log. Include paper files, digital copies and duplicates collected during the work. Even when another organisation handles storage, make sure it remains clear that you decide what to retain.

Reviewing records for destruction

A destruction review checks whether a record has reached the end of its retention period and whether there is any continuing reason to keep it. Review record categories against your schedule instead of deleting files simply because they look old. Check for an ongoing complaint, legal matter or other documented reason to retain them. If none applies, arrange secure disposal. The HGI policy says it should be reviewed every three years, or sooner if relevant requirements change. Reviewing the policy helps keep your process aligned with current needs.

Recording file destruction

A destruction log records which files were destroyed, when and how. Include the date, record category, disposal method and the person or third party responsible. You don’t need to include client information in the log; avoid creating another identifiable record without a clear purpose. For example, record that a closed paper case file was securely shredded rather than copying its contents into the log. Store the log securely and use it to document how your process supports compliance.

For digital files, include shared folders and accessible copies in your disposal process; deleting a desktop shortcut alone won’t remove the stored record. If you’re tightening several practice systems alongside record handling, practical practice-management support can help you build a routine you can maintain.

Deletion or anonymisation of personal data

Deletion removes personal data from the files and systems where you hold it; anonymisation changes it so people can no longer be identified. UK Government data protection rules say identifiable personal data should be kept no longer than necessary for its purpose. The UK GDPR right to erasure is set out in Article 17. I’d consider each request against the record’s purpose and any relevant reason for retaining it.

Deleting or anonymising records

Anonymisation removes identifying details so information can’t be linked to a person. The HGI recommends that therapists pseudonymise records 1 year after therapy ends when practicable. I’d remember that pseudonymised information remains personal data if separate information can link it back to someone. Fully anonymised records may be kept beyond 7 years where there’s a lawful reason. If you’re transferring material to archives for research or statistical purposes, consider whether it’s genuinely unidentifiable and whether GDPR Article 89(1) applies.

If you use a case note for learning, remove the client’s name and any details that could identify them. Check for indirect clues too, such as a distinctive workplace or event. If someone could still work out who the client is, treat the material as personal data.

Recruitment and personnel records

Recruitment records are personal data collected during an application or hiring process. UK application and recruitment records may be retained for 6 to 12 months. I’d set a period that fits why you’re keeping each item, then delete it when that purpose ends unless a relevant reason supports longer retention.

Personnel records contain information about someone’s employment. In the UK, HR records other than salary and pay details should generally be kept for at least three years. Payroll records have a separate minimum retention period of six years. Keep these categories separate in your schedule so that deleting an application file doesn’t remove records that still need to be retained. Record the purpose and review each period when relevant requirements or circumstances change.

Client and third-party documents

Client documents are records created or received during therapy, including case notes, letters and reports. I’d keep associated documents with the relevant case record, so their retention period follows a clear purpose rather than the document’s format. HGI policy recommends retaining adult clients’ case notes and associated documents for 7 years after therapy ends. For clients who were under 18, it recommends keeping records until 7 years after their 18th birthday.

A third-party document is information another person or organisation supplied or created, such as a referral letter or assessment. If it contains identifiable client information, I’d include it in your records management process. The HGI policy says records should not be kept beyond 7 years without a lawful basis, and clients must be informed if their records will be kept longer. Guidance about a document’s original source doesn’t automatically settle how long you should retain your copy.

Start with the document’s purpose. A referral letter may help explain why therapy began, while a report might support ongoing work. Record why you retain each item and whether you still need it alongside the case notes. If its purpose has ended, include it in the file’s scheduled review instead of letting it drift into indefinite storage.

General data protection principles apply to identifiable information in third-party documents just as they do to your own notes. Limit access to people who need the information for their work. If you keep a document beyond the usual period, record the reason, relevant lawful basis and next review point. Research, a complaint or another continuing matter may affect retention, but make the reason specific to that file. Your client contract and privacy notice should explain the retention period and what happens afterwards, in line with the HGI policy.

Martin Hogg Private Practice Success

Martin Hogg Private Practice Success supports counsellors who want to develop their private practice with more clarity and purpose. Setting appropriate record-retention processes is one practical part of running a practice. It can sit alongside decisions about your direction, visibility and professional development.

If this has prompted you to consider the wider picture, One-to-One Practice Growth Coaching gives you space to focus on developing your practice. The Practice Visibility Blueprint may also help if you’re thinking about how clients find and understand your work. These address different needs, so start with the question that matters most to you now.

To discuss your next step, contact Martin Hogg Private Practice Success.

Make your records process easier to maintain

Deciding how long to keep client records in the UK is also a chance to make the practice behind the therapy more manageable. The next step doesn’t need to be a perfect policy document. It’s a routine you can follow when a client finishes, a new document arrives, or your practice changes. A clear owner and review point help stop records management becoming another admin job that gets put off.

Choose one part of your process to improve first. You might make your retention schedule easier to use or set a regular time to review files. Small, repeatable steps are more practical than a complicated system you can’t maintain. As your practice develops, revisit the process to make sure it still fits the way you work.

You don’t need to sort everything in one sitting. Start with one practical change, then build from there.

Frequently Asked Questions

How long should UK sole traders and limited companies keep client records?

The retention period depends on the record and its purpose, not simply whether you’re a sole trader or limited company. For therapy files, the HGI policy recommends keeping adult clients’ case notes and associated documents for 7 years after therapy ends. For a client who was under 18, it recommends keeping records until 7 years after their 18th birthday. Keep business accounting records separately under their own schedule.

What UK GDPR rules apply to retaining client personal data?

UK GDPR requires you to keep identifiable personal data only for as long as necessary for its purpose. The HGI policy says your privacy notice should state how long you will retain records and what will happen to them afterwards. For example, if you keep a file beyond your usual schedule because of an ongoing complaint, document the reason and review the decision when the matter ends.

How should UK businesses securely destroy client records after the retention period?

Use a disposal method that prevents anyone from recovering or reading the information. Arrange secure shredding for paper files; securely delete digital records and accessible copies. If a storage or destruction company handles disposal, keep its confirmation with your own record of the destruction date, record category and method. Don’t put identifiable case notes in ordinary waste or leave digital copies in shared folders.