How long should counsellors keep client records in the UK?

"How long do I keep client records?" looks like it should have a one-line answer. It does not, and anyone who hands you a single number without asking about your practice has skipped the actual requirement. The requirement, set by UK GDPR's storage limitation principle, is a defined and justified policy: periods you chose, reasons you can point to, and both written down where a client could read them.

The numbers below are reference points to assess, not automatic deletion dates. Howden explains a possible seven-year period for adult records; NHS England has separate schedules for children and mental health records. Your care obligations, possible claims, insurer and any applicable legal requirements all matter.

The data protection principles apply across the UK, on paper and in digital tools. The claim time limits below describe England and Wales, and the NHS examples come from NHS England. Scotland and Northern Ireland have different limitation rules: obtain advice for your jurisdiction before adopting a period. What happens to records in Joy has one marked section near the end.

UK GDPR and the Data Protection Act 2018 govern your client records, and on the question of how long, the ICO is direct:

"The UK GDPR does not set specific time limits for different types of data. This is up to you, and will depend on how long you need the data for your specified purposes." (ICO, storage limitation)

"Up to you" comes with homework attached. The same guidance says you need to "establish and document standard retention periods for different categories of information you hold wherever possible", that you must be able to justify keeping data in a form that identifies people, and that at the end of a standard period you should review, then erase or anonymise unless there is a clear justification for keeping the data longer. A retention policy, in other words: written, reasoned and reviewed. For a solo practice it fits on one page.

The ICO says possible future legal claims can justify retaining information. This is one factor alongside your care needs and any legal or professional obligations. It does not justify keeping every record indefinitely.

One thing that does not change the answer: counselling records are health data, which UK GDPR treats as special category data. That raises the bar for how securely you keep them and on what basis, which our guide to using AI for counselling notes covers in more depth. The storage limitation principle itself asks the same of everyone: no longer than necessary, and you define necessary.

This is general guidance, not legal advice for your practice. If you are unsure, the ICO's helpline is free, and your professional indemnity insurer will have a view too.

BACP does not set a retention period, and says so itself. Its UK GDPR FAQs put it this way:

"Data Protection legislation does not set specific time limits but requires that you only keep information for as long as is necessary for the specific purpose it was originally collected." (BACP, UK GDPR FAQs)

The same FAQ lists the factors it expects members to weigh: any legal or regulatory requirements that cover your records, whether your indemnity insurer specifies a time period, your organisation's policies, and its complaint timescales. The FAQ describes three years after counselling ends; BACP's current complaints guidance says three years from the event, with later complaints possible for good reasons. Do not treat three years as a guaranteed cut-off.

A March 2026 blog on notes and record keeping by BACP's client ethics manager says the quiet part plainly: "there's no simple answer to this question", and therapists who seek advice may receive very different answers. It notes that because a complainant has up to three years to submit a complaint, "a member may decide to retain their notes for a minimum of three years", and that it is for the therapist or the organisation to decide an appropriate time limit before destruction.

The Ethical Framework 2026, mandatory from 3 November 2026, sets standards for what records must be: clause 3.2 asks for records that are factual, adequate and relevant, stored securely, and meeting the data protection requirements of the country where they are stored. It does not set a duration. The complaint window is a factor to consider, not a BACP retention rule or a guarantee that no later complaint or claim is possible. Choose and justify your period in light of all the requirements that apply.

Howden, an insurance broker that publishes note-keeping guidance for therapists, gives seven years as a possible starting point. Its example adds a year to the six-year period for a contract claim to allow for delay between a claim being issued and served. Howden makes clear that this is not definitive, particularly in cases involving children. It is one named broker's guidance, not a rule for every practice.

In England and Wales, the Limitation Act 1980 generally allows six years for simple contract claims (section 5) and three years for personal injury claims (section 11), with qualifications including later knowledge, children and the court's discretion. Three years is not the limit for every negligence claim. These are claim rules, not a retention schedule, and some cases have different or extended time limits.

Read your insurer's and any commissioning organisation's requirements alongside data protection law. If a period is specified, check how it applies to your records and document the reason for using it. For couples or linked clients, take advice on the relevant end dates and each person's rights rather than applying one automatic clock to all records.

The NHS number, and why it is different

One useful reference is the Records Management Code of Practice (NHS England, current online code). Its retention schedule for care records keeps general adult health records for 8 years, mental health records for "20 years, or 10 years after death", and children's records until the 25th birthday, or the 26th if the patient was 17 when treatment ended.

The code covers NHS organisations and providers of NHS-commissioned care in England. A wholly private practice should not adopt its periods automatically. Check the category, retention trigger and review instructions that apply: the general children's schedule does not replace a more specific mental health schedule. Continuing care needs, legal claims and special circumstances may justify longer retention.

Children's records need a separate decision. In England and Wales, section 28 of the Limitation Act 1980 extends time limits where a claimant was a child when the claim arose. An ordinary personal injury claim can commonly be brought until age 21, and exceptions can allow longer. That is not a safe deletion age for every record or every type of claim.

For comparison, NHS England's general children's schedule uses the 25th birthday, or the 26th if treatment ended at 17. Mental health records have their own schedule. For private practice, agree an appropriate period with your insurer or legal adviser, taking account of the work, jurisdiction and any safeguarding or legal issues. Document the chosen period and review it before destroying records.

The same principles, applied. Starting points to adapt, with the reasoning next to each so you can defend or depart from it.

Retention runs into client rights in two places, and they pull in opposite directions.

A client can ask you to erase their records, and the right to erasure is real but not absolute. The ICO's guidance lists the situations where it does not apply, and one of them is processing necessary "for the establishment, exercise or defence of legal claims". Assess each request individually. An unexpired retention period alone is not enough: establish why the records are still necessary and which exception applies. If you refuse, explain your reasons and the client's rights to complain to the ICO or seek a judicial remedy, without undue delay and within one month. The flip side is just as firm: in the ICO's words, "individuals have the absolute right to erasure of personal data that you no longer need for your specified purposes". A retention policy you never review is how you end up holding data you have no answer for.

Separately, a client can ask to see their records. A subject access request entitles them to a copy of their personal data, free of charge in most cases, normally within one calendar month. That is one more reason to write notes you would be comfortable handing over, and to know exactly where every record for a client lives. When the request comes from a court, the police or a solicitor instead of from your client, different rules apply, and our guide to counselling notes and the court walks through each route.

The whole of the above, as a list. An hour once, then a small review each year.

This is the section about us. Everything above applies whatever you use for notes; here is how the same questions land in Joy, with the documents linked so you can check.

Put your policy into practice

If Joy's policies say something different from this page, the page is wrong and we will fix it. Tell us at hello@joy.day. Weighing Joy against another tool? We keep a side-by-side with Upheal, including where they win.