How long to keep counselling notes in the UK

A retention period is the length of time you keep a client's notes after the work has ended, before you destroy or anonymise them. In the UK, no statute sets that period for counsellors or psychotherapists in private practice. You set it yourself, you justify it, and you tell your clients.

That freedom worries many practitioners. Most would prefer a number. This guide gives you the benchmarks that do exist, explains where each one comes from, and ends with a short list of decisions you can turn into a written policy this week.

What the law says: no longer than necessary

The relevant rule is the storage limitation principle in Article 5(1)(e) of UK GDPR. Personal data must be kept in a form that identifies people for no longer than is necessary for the purposes for which it is processed.

The ICO is clear on the key point. Its guidance states that "The UK GDPR does not set specific time limits for different types of data." It is up to you to decide how long you need the data, based on why you hold it.

The ICO also expects you to do three things:

• Set and document standard retention periods for each kind of information, where you can.
• Review the data you hold regularly, and delete or anonymise anything you no longer need.
• Justify the periods you choose. The ICO says industry guidelines are "a good starting point", but they "do not guarantee compliance".

The ICO notes that small organisations doing occasional, low risk processing may not need a documented policy. Counselling notes are health data and are highly sensitive. A short written policy is the sensible choice for any counsellor.

BACP says the same thing in its UK GDPR FAQs. Data protection law "does not set specific time limits", so "you will need to decide how long you need to keep personal data and set retention periods."

What BACP says

In a blog on notes and record keeping published on 20 March 2026, BACP's Client Ethics Manager writes that there is "no simple answer" to the question of how long to keep notes. BACP does not fix one period for its members.

It does give a worked example. Because its complaints procedure allows three years, a member "may decide to retain their notes for a minimum of three years from when the therapeutic relationship ended." Its GDPR FAQs confirm the time limit for raising a complaint is currently three years after counselling has ended under its Professional Conduct procedure.

The BACP pages add a few practical points:

• Therapists should make it clear before therapy starts whether they make notes, and should tell clients how long they keep them.
• If you are employed by an organisation, you are expected to follow its retention policy.
• Check whether your indemnity insurer specifies a time period.
• When the period ends, records should be destroyed in a way that prevents anyone accessing or using them.

Three years is a floor that links to a BACP process. It is not a legal maximum or a legal minimum. Other reasons, such as working with children or with an NHS contract, can point to a longer period.

The NHS England Records Management Code of Practice

The Records Management Code of Practice is published by NHS England and was last updated on 7 August 2023. It applies to organisations working within, or under contract to, the NHS in England. The code says private providers can also use it for guidance. If you see NHS-funded clients, through a contract or a subcontract, check what your contract requires.

Its retention schedule gives these periods for the record types most relevant to therapists:

• Adult health records not covered elsewhere in the schedule: 8 years.
• Children's records: keep until the 25th birthday, or the 26th if the patient was 17 when treatment ended.
• Mental health records, including psychology records: 20 years, or 10 years after death.

The code also says that at the end of a retention period, no record should be automatically destroyed. Each one is reviewed and then destroyed, kept longer with a written reason, or preserved. Records must not be destroyed while they are the subject of a subject access request or while there is a reasonable prospect of legal proceedings.

For a counsellor in private practice, these figures are a benchmark, not a duty. They explain the long periods you may hear about, such as keeping a child's notes until they turn 25.

The CSP benchmark for physiotherapists

Some readers work alongside physiotherapists, or run a mixed practice. The Chartered Society of Physiotherapy record keeping guidance, last reviewed on 19 August 2025, gives these periods:

• Adults: "Eight years from the date of last treatment".
• Children: "Eight years after their 18 birthday or until 25 years of age".

The CSP notes that each UK country sets its own minimum retention periods for NHS health records. It also reminds sole practitioners that they carry all data protection duties, including storage, retention and security.

What about the "6 to 7 years" figure?

You may have heard that therapy notes must be kept for 6 or 7 years. None of the sources used for this guide sets that figure for counselling or therapy notes. That includes the ICO, BACP, NHS England and the CSP. Do not treat it as a rule. If your insurer or a contract asks for a specific period, follow it, and write down that this is your reason.

Choosing your own retention period

Because the decision is yours, the important thing is that it is reasoned and written down. Here are the questions that usually shape it.

Who are your clients?

Adults only, or children and young people as well? If you work with under 18s, the NHS code and the CSP both point to keeping notes until around the client's 25th birthday. Many practitioners choose to follow that.

Who pays for the work?

If you see clients under an NHS contract, an employee assistance programme or an agency, the contract may set the period. Employed counsellors follow their employer's policy.

What does your insurer say?

BACP lists the indemnity insurer's time period as a point to check. Ask your insurer in writing and keep the answer with your policy.

What is the minimum you need?

BACP suggests you consider whether you can minimise a file after a certain time. For example, you might delete some of the information you hold on a client and keep only limited data. BACP also notes that anonymising your records is the same as deletion.

Do your process notes follow the same rule?

Some counsellors keep personal process notes for supervision, separate from the client file. Decide whether these sit inside or outside your retention policy, and be consistent. Our guide to process notes and records in counselling looks at this distinction.

Tell your clients

A retention period only works if clients know about it. BACP says therapists should explain before therapy starts whether they make notes and how long they keep them. Put it in two places.

• Your counselling contract. One or two plain sentences, for example: "I keep brief notes of our sessions. I keep them securely for [X] years after our work ends, then I destroy them securely." See our counselling contract template for wording.
• Your privacy notice. BACP says your privacy statement should explain, without jargon, what data you keep, how long you keep it, what you do with it and who you share it with.

If you still hold notes you can justify keeping, but you did not explain your policy when you collected them, BACP says you ought to contact those clients to explain it.

Secure deletion at the end of the period

Paper notes with personal data must be shredded, according to BACP. Electronic notes are harder. BACP warns that you must make sure the data cannot be "un-deleted" or restored from backups. The ICO adds that moving data to offline storage is not the same as deleting it.

A simple routine helps:

1. Note the end date of each client's work in your file or diary.
2. Once or twice a year, list the files that have passed your retention period.
3. Check none of them is subject to a complaint, a legal claim or an access request.
4. Delete or shred them, including copies in email, cloud folders and backups.
5. Keep a short log of what you destroyed and when, without client detail.

Clients can also ask you to erase their data. The ICO says you must then review whether you still need it. A live complaint or a legal reason may justify keeping it. If so, explain that to the client.

If you stop practising

Your notes do not disappear when you stop practising. BACP advises private practitioners to plan for the remaining records to be destroyed in a confidential manner after their death or the end of their practice. This is usually done through a clinical will, which names an executor, usually a fellow professional or supervisor, who takes responsibility for your notes.

When you close your practice, it makes sense to keep the periods you promised. Keep the notes secure until each period ends, then destroy them as planned. An end of therapy summary can make this easier, because it gives a short, clear account of the work if a client later asks for it.

Your decision list

• Pick a retention period for adult clients, with a written reason (for example, BACP's three year complaint window, your insurer's request, or the NHS code as a benchmark).
• Pick a period for children and young people, if you work with them.
• Check any NHS, agency or employer contract and follow its period where it applies.
• Ask your indemnity insurer whether it specifies a period.
• Decide how process notes and supervision notes are handled.
• Add the period to your counselling contract and privacy notice.
• Set a yearly date to review and securely delete files that have passed the period.
• Write a clinical will and brief your clinical executor.

How Delta fits in

Delta is an AI assistant for mental health and allied health practitioners. During the session, it transcribes what is said, then prepares a session report that you review and validate. You can also dictate observations right after the session or add written notes. The report is added to the client file, so each client's follow-up sits in one place, which makes it easier to see what you hold when a retention date arrives. Delta also drafts letters and assessment reports from clinical document templates.

On security, data is hosted in France with a host certified for health data (HDS, the French health data hosting certification). AI processing, transcription included, runs on servers located in France. The client's name and identifying details are pseudonymised before AI processing, no audio file is kept, data is never used to train models, and data is encrypted in transit and at rest. Your retention policy stays your responsibility, so ask any provider, Delta included, how deletion works and for its data processing agreement. More details are on our security page and our page for therapists.

Sources

• BACP, Notes and record keeping (blog, 20 March 2026): bacp.co.uk.
• BACP, FAQs about UK GDPR and the Data Protection Act 2018: bacp.co.uk.
• ICO, Principle (e): Storage limitation: ico.org.uk.
• NHS England, Records Management Code of Practice (updated 7 August 2023): transform.england.nhs.uk.
• Chartered Society of Physiotherapy, Record keeping guidance (last reviewed 19 August 2025): csp.org.uk.