Record keeping for counsellors and psychotherapists in Ireland: IACP, CORU and the Data Protection Act 2018

Record keeping for counsellors and psychotherapists in Ireland means keeping a clear, dated and secure file for each client, holding it for a period you have set in writing, and releasing it only to people with a legal right to see it. Until CORU opens its registers, the rules come from your professional body and from Irish data protection law.

Where statutory regulation stands in November 2026

The Minister for Health confirmed the establishment of the Counsellors and Psychotherapists Registration Board within CORU on 27 February 2019. Its Standards of Proficiency were published in July 2025, and CORU gives training programmes four years to align. CORU's FAQ is direct: “At present, it is not possible to provide a definitive date for the opening of the registers for counsellors and psychotherapists” (CORU, FAQ (b) Opening of the Registers).

Still ahead: “Setting the Code of Professional Conduct and Ethics”, then the opening of the register with a two-year grandparenting period. On 4 November 2026, the CORU page of Codes of Professional Conduct lists eleven codes and none for counsellors or psychotherapists. No CORU record keeping rule applies to you yet.

Standard 5.38 of the Standards of Proficiency for Counsellors expects graduates to “Be able to write concise, accurate and relevant notes and records which articulate and justify professional decisions made”. Standard 5.36 of the Standards of Proficiency for Psychotherapists uses almost the same words, adding “professional formulations” to what notes must justify. If your notes meet that sentence today, nothing will change for you when the registers open.

What the official texts say about your records

IACP Record Keeping and Retention Guidelines

The IACP Record Keeping and Retention Guidelines (V2.1) are the most precise Irish text on the subject. On retention: “IACP recommends that, in the absence of a superseding requirement, Counsellors/Therapists retain records for a period of 7 years after the last date of service delivery.” For minors: “Records for children and young people should be retained until the client is 25 (or 26 if they are 17 when therapy sessions end) or 8 years after their death, if sooner.” And: “If under investigation or if litigation is likely, retain files as they may be used as evidence.” The IACP adds that some insurers require longer.

Its principles for each file:

• Timing. “Records should be contemporaneous and record any decisions made”, signed and dated at the time of writing.
• Security. “Records held on computer systems should be password protected”; paper for destruction is shredded.
• Third parties. “Obtain clear written permission from your client to release any appropriate information”.

The IACP also asks for a written record keeping policy and advises putting the retention period in the client contract.

IAHIP Code of Ethics and Practice

The IAHIP Code for psychotherapists (Bye Law 6A, in force from 1 August 2025) says psychotherapists are responsible for “the secure transit, storage, retrieval and disposal of records both written and electronic” and “must comply with all statutory requirements including GDPR” (5.6). It sets no retention period.

GDPR and the Data Protection Act 2018

Session notes are data concerning health, a special category under Article 9 GDPR. In Ireland, section 52 of the Data Protection Act 2018 allows that data to be processed for “the provision of medical care, treatment or social care” when the work is done by a health practitioner or by “a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner”. While the CORU registers are closed, we suggest naming Article 9(2)(h) and section 52 in your privacy notice and relying on the duty of confidentiality in your professional code.

The client's right of access

The Data Protection Commission says a controller must answer an access request “within one month of receipt of the request”, extendable by two further months for complex requests if you tell the client why before the first month ends (DPC). For health records, the DPC explains that access covers anything on file or computer that relates to the person.

Ireland has a specific exception. The Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (S.I. No. 121 of 2022) allow access to be restricted only “to the extent that is necessary and proportionate”, where access “would be likely to cause serious harm to the physical or mental health of the data subject”. You may first consult a qualified health practitioner, sharing the data “in pseudonymised form” (regulation 8). If you withhold data, you must tell the client that, on request, such a practitioner can be given access to it (regulation 9).

Children First Act 2015

Schedule 2 of the Children First Act 2015 names as mandated persons a “psychotherapist or a person providing counselling who is registered with one of the voluntary professional bodies”. Tusla explains that mandated persons report concerns at or above a defined threshold, and “must also assist Tusla, on request, in its assessment of child protection concerns”. For your records: state the legal limits of confidentiality in your contract, and keep a dated note of any report and of what was shared.

What to keep, how long, and who can see it

The HSE Record Retention Periods policy (2013) gives a longer public service benchmark.

• Adult client file (contract, consent, assessment, session notes, correspondence, ending summary) | How long: 7 years after the last date of service (IACP). HSE psychology records: “20 years after the last entry in the record or 8 years after the patient's death” | Access: you, the client (access request), others only with written consent or a legal obligation.
• Child or young person | How long: until age 25, or 26 if 17 when therapy ended (IACP; the HSE uses the same rule) | Access: the young person; parents or guardians as the law allows; Tusla on request under Children First.
• Client who has died | How long: for minors, 8 years after death if sooner (IACP) | Access: confidentiality continues after death (IAHIP 8.2).
• Complaint, investigation or likely litigation | How long: keep until it is fully closed, whatever the normal date | Access: court, regulator or body hearing the complaint, as the law allows.
• Process notes and personal jottings | How long: no Irish rule; we advise the same period as the file, or not keeping them at all | Access: if they identify the client, they fall within an access request.
• Supervision notes | How long: set by the supervisor's own policy | Access: keep clients unidentifiable, as the IAHIP Code advises (6.2 and 10.4).

For a wider comparison with UK rules, see how long to keep counselling notes in the UK.

Record keeping policy: a model you can copy

Replace the parts in square brackets and give it to clients with your contract.

Record Keeping and Retention Policy of [Name], [IACP / IAHIP] accredited counsellor/psychotherapist, [practice address]. Version [1.0], adopted [date], next review [date + 12 months].

1. What I keep.

• Contact details, GP and emergency contact.
• Signed contract, consent forms, initial assessment and goals.
• A short note of each session, written within 24 hours, signed or validated and dated.
• Correspondence, reports, any disclosure with its legal basis, and an ending summary.

2. What I do not keep. I do not keep separate process notes after the session note is written. I do not store client information on personal messaging apps or personal email. In supervision, I never name clients.

3. Legal basis. I process health data under Article 9(2)(h) GDPR and section 52 of the Data Protection Act 2018, as a person bound by a duty of confidentiality under the [IACP / IAHIP] Code of Ethics.

4. Storage and security. Electronic records are in [name of system], encrypted, with two-step sign-in, hosted in the European Union. Paper records are in a locked cabinet at [address]. My devices are encrypted.

5. Retention. Adults: 7 years after the last session. Clients under 18: until their 25th birthday, or 26th if they were 17 when therapy ended. Files linked to a complaint or legal proceedings are kept until these are closed. I checked my insurance policy on [date]; it requires [no longer period / X years].

6. Destruction. Each [January], I review files that have reached their date. Paper is shredded; electronic files are deleted, backups included. A log keeps the client reference, date and method only.

7. Access by the client. I reply to any request within one month, free of charge. I restrict access only as allowed by S.I. No. 121 of 2022.

8. Disclosure to others. Only with the client's written consent, after showing them the content, or where the law requires it (Children First Act 2015, court order).

9. Breaches. If a record is lost or exposed, I notify the Data Protection Commission within the GDPR deadline where required.

10. Incapacity or death. [Name of colleague], [accreditation], holds a sealed list of current clients, contacts them and applies this policy.

A fictional example, filled in

Fictional case. Aoife, an IACP accredited counsellor in Galway, saw Conor (fictional, born 3 March 2009) for 14 sessions. The last session was on 20 May 2026, when Conor was 17.

• Retention date: Conor's 26th birthday, 3 March 2035 (IACP rule for a client who was 17 at the end of therapy). Entered in her file index at closure.
• Ending summary: “20/05/2026. 14 sessions. Presenting issue: exam stress and low mood after a family bereavement. Goals reviewed: sleep routine re-established, returned to school football. Ending agreed jointly. Conor knows he can return. Signed A.”
• Access request: on 2 October 2026, Conor emails asking for his notes. Aoife confirms his identity and sends a full copy on 15 October, inside the one-month limit.

Checklist

• I have a written record keeping policy with a version date.
• My client contract states retention periods, limits of confidentiality and what happens to records if I die or cannot practise.
• My privacy notice names Article 9(2)(h) GDPR and section 52 of the Data Protection Act 2018.
• My devices are encrypted; I know where each tool stores data and have a processing agreement with it.
• I can answer an access request within one month and I know when S.I. No. 121 of 2022 applies.
• I know whether I am a mandated person under the Children First Act 2015.

Common mistakes

• Treating process notes as private. If they identify the client, they are personal data, and an access request can reach them. Read our page on process notes versus records.
• Withholding a whole file. S.I. No. 121 of 2022 allows a restriction only where serious harm is likely, only to the necessary part, and “for as long as necessary only to protect the health of the data subject” (regulation 4).
• Using a cloud or AI tool without checking it. Know where data is hosted and whether it is used for training. Our DPIA guide for AI note-taking walks through the questions.

Why Delta fits Irish record keeping

Delta is a clinical assistant for mental health professionals that keeps the memory of every client. It transcribes what is said during the session, or takes your dictation afterwards, then drafts a short and a detailed summary adapted to your approach and updates the client file (summary of the work, goals followed). You get dated notes written at the time, in one place, as the IACP asks. Data stays in Europe, in France, on infrastructure certified for health data; names and identifying details are pseudonymised before AI processing; no audio is kept; data is never used to train a model. There is a free plan (10 sessions a month) and a 14-day trial with no card. See also our clinical document templates.

Sources

• IACP, Record Keeping and Retention Guidelines, V2.1 (undated, read 4 November 2026).
• CORU, Counsellors and Psychotherapists Registration Board, FAQ (b) Opening of the Registers (read 4 November 2026).
• Data Protection Act 2018, section 52 and S.I. No. 121 of 2022 (Irish Statute Book).
• Data Protection Commission, response time for access requests.
• HSE, Record Retention Periods, Health Service Policy (2013).