How long should you keep client notes in the UK?

What UK GDPR, BACP, the HCPC and the CSP say about how long therapists, counsellors and health practitioners should keep client records, and how to set a policy.

MyWellOps teamPublished 28 September 2026 · 6 min read

There isn’t a single UK number for how long to keep client notes, and anyone who gives you one without asking what you do is guessing. The honest answer has three layers:

Data protection law says: no longer than you need, and you must be able to justify it.
Your regulator or professional body tells you what “need” means for your profession, sometimes with a specific minimum.
Your own policy turns that into a period you apply consistently and tell clients about.

This guide goes through each layer and ends with a way to write your own policy.

What the law says: storage limitation

UK GDPR’s storage limitation principle says personal data must be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes” it was collected for. The ICO’s guidance sums this up plainly:

You must not keep personal data for longer than you need it.
You need to think about, and be able to justify, how long you keep personal data.
You should periodically review the data you hold, and erase or anonymise it when you no longer need it.
Individuals have a right to erasure if you no longer need the data.

There’s no maximum retention period in the legislation. Instead, the ICO expects you to set periods based on things like your purposes, whether you might need the records to defend a legal claim, legal or regulatory requirements, and relevant industry standards or guidelines. That last point is where your professional body comes in.

The ICO also says that if you’re a small organisation doing occasional low-risk processing, you may not need a documented retention policy. Most therapists hold health information about every client, though, so writing one down is the sensible choice.

What professional bodies say

Counsellors and psychotherapists (BACP)

BACP’s position, set out by its Client Ethics Manager in March 2026, is that there’s no simple answer. Data protection law says personal data shouldn’t be held longer than necessary for its original purpose. Where no time limit is set for therapeutic records, therapists (and their organisations) need to decide an appropriate time limit before destruction and tell all their clients what it is.

BACP gives one useful anchor. Its complaints procedure gives a complainant up to three years to submit a complaint, so a member may decide to keep notes for a minimum of three years from when the therapeutic relationship ended.

It also recommends that:

therapists make it clear before therapy starts whether they make notes, how long they keep them and what happens to them
records are destroyed at the end of the period in a way that stops anyone accessing or using them
therapists in private practice arrange for confidential destruction of their records after their death or the end of their practice, usually through a clinical will naming an executor (often a fellow professional or supervisor)

BACP also notes that practice varies. One therapist may log only session dates and times, while another keeps detailed notes, depending on training and approach. Your retention policy should cover whatever you actually keep.

HCPC-registered professions

The HCPC doesn’t set a retention period. It says the right period “will vary according to the context in which you practise”, and that you should use your professional judgement, the relevant law and best practice for your profession to decide.

For schedules to work from, the HCPC points registrants to:

the Records Management Code of Practice for Health and Social Care 2021 (England and Wales)
the NHS Code of Practice 2020 (Scotland)
Good management, good records (Northern Ireland)

The HCPC notes that although these are aimed at the NHS, they’re useful for everyone. It also expects registrants to follow guidance from their professional body, where there is some.

Physiotherapists (CSP)

The Chartered Society of Physiotherapy is more specific. Its record-keeping guidance (last reviewed August 2025) gives minimums of eight years from the date of last treatment for adult records, and for children, until they are 25 or eight years after their 18th birthday.

The CSP points out that retention periods vary by UK country. In Scotland the minimum for adults is six years; in England it’s eight. It also says that members in private practice are expected to mirror NHS guidance for their country, taking account of their own context.

Other professions

If you’re a member of a different body (for example UKCP, NCPS, or an association for a complementary therapy), look for its record-keeping guidance and use that. If it doesn’t give a period, the approach above still works: pick a period you can justify, write it down, and tell clients.

Don’t forget the non-clinical records

Clinical notes aren’t the only records you keep. Your financial records have a separate, fixed rule. If you’re self-employed, HMRC requires you to keep business records for at least five years after the 31 January submission deadline of the relevant tax year. Invoices and payment records fall under that, so they may need to be kept on a different timetable from session notes.

Writing your retention policy

A retention policy for a small practice can fit on one page. It should say:

What you keep. Intake forms, consent forms, session notes, correspondence, recordings if you make any, invoices.
How long you keep each type, and why. For example: “Session notes are kept for [X] years after our last session, in line with [professional body] guidance.” Cite the guidance you’re relying on.
When the clock starts. Usually the end of the working relationship or the last appointment, not the date each note was written.
Special cases. Children and young people, clients involved in legal proceedings, and anyone who has made a complaint may need different periods. The CSP’s guidance, for example, sets a separate minimum for children’s records, and the ICO lists defending legal claims as a reason that can justify keeping records longer. Ask your professional body what applies to you.
How you destroy records. Secure deletion from every system and backup, and cross-cut shredding for paper.
What happens if you can’t practise. Your clinical will, and who holds access.

Then put it into practice:

Include your retention period in your privacy notice and your intake paperwork, so clients hear it before you start.
Set a review date, say once a year, to find records that have passed their period.
Record what you destroyed and when (without keeping the content).

A note on software

If you keep notes in practice management software, check two things. First, can you find and delete a closed client’s records when their retention period ends? Second, are there copies anywhere else, such as recordings, exports, email attachments or downloaded PDFs?

In MyWellOps, notes sit on the client record. If you use AI Notes (only with the client’s consent), session recordings are deleted after 30, 60 or 90 days, or when you save the note, depending on your setting. That’s separate from how long you keep the note itself, which remains your decision under your policy.

The short version

UK GDPR: keep records no longer than necessary, and be able to justify the period.
BACP: no fixed period. Three years after therapy ends is a reasonable minimum, given its complaints window. Tell clients up front.
HCPC: no fixed period. Use the NHS records management codes for your country and your professional body’s guidance.
CSP: at least eight years after last treatment for adults in England, six in Scotland. For children, until 25 or eight years after their 18th birthday. Private practitioners should mirror NHS guidance.
HMRC: business records for at least five years after the 31 January deadline.

If your situation is unusual, such as a legal case, safeguarding concerns or a complaint in progress, check with your professional body or insurer before you destroy anything.

Get booked

Run the session

Stay in touch

Get paid

Grow