How Long Should Therapists Keep Client Notes? (UK Guide)

Record retention is one of those areas where UK therapists often aren't sure what they should be doing — and the consequences of getting it wrong can be serious, both professionally and legally. This guide gives you a clear answer on how long to keep client notes, what your storage obligations are, and what happens when you need to dispose of records.

How long to keep therapy notes: what BACP says

There is no statutory retention period for private counselling and psychotherapy records. Professional bodies give guidance, and you set your own policy within it:

• BACP says private practitioners may keep notes for a minimum of three years from when the therapeutic relationship ended. This reflects BACP's complaints procedure, which gives complainants up to three years to complain.
• BPC guidance says records are typically kept for six years after treatment ends, subject to that retention being justifiable under UK GDPR.
• Your insurer may have its own expectations. Check your policy or ask them directly.

Where no fixed period applies, set one you can justify, tell clients what it is, and destroy records securely when it ends. You can keep a particular record longer if there is a legitimate reason, for example ongoing legal proceedings.

Why many therapists keep records for six or seven years

Under the Limitation Act 1980, most claims for breach of contract or negligence in England and Wales must be brought within six years. Personal injury claims have a three-year period, which can start later, from the date the person knew about the injury. For someone who was a child at the time, time generally does not start running until they turn 18. That is why many therapists and insurers suggest keeping adult records for six to seven years, and why records for clients who were children need separate thought. If a complaint or claim is made, your records are your evidence of the care you provided.

Scotland and Northern Ireland have their own limitation rules, so take advice if you practise there.

What counts as a client record?

Everything you hold about a client is potentially a client record:

• Session notes (SOAP, DAP, BIRP, or other format)
• Intake assessments and risk assessments
• Correspondence (emails, letters, text messages)
• Invoices and payment records (separate from clinical records but still personal data)
• Supervision notes that identify the client (even by reference code, if the code is traceable)
• Any assessments, questionnaires, or formulations

UK GDPR and retention: what the law requires

UK GDPR's storage limitation principle requires that personal data is not kept for longer than necessary for its original purpose. For therapy records, "necessary" is shaped by your professional obligations, your insurer's requirements and the limitation periods for claims.

You must document your retention policy in your privacy notice. This should state:

• How long you keep records after therapy ends
• The basis for this retention period
• How records are securely disposed of at the end of the retention period

Client rights: Subject Access Requests

Under UK GDPR, clients have the right to request a copy of all personal data you hold about them — including their clinical notes. This is called a Subject Access Request (SAR).

If you receive a SAR, you must:

• Respond within one month. You can extend this by two further months if the request is complex, but you must tell the client why within the first month
• Provide copies of the personal data you hold about that person, based on a reasonable and proportionate search
• Provide this free of charge in most circumstances

Since 5 February 2026, if you genuinely need the client to clarify what they are asking for, the clock stops while you wait for their answer. Since 19 June 2026, you must also have a way for people to complain to you about how you handle their data, and your privacy notice and SAR responses should mention it.

There are limited grounds for withholding information from a SAR, including:

• Information that identifies another person, where it would not be reasonable to disclose it without their consent
• Health information where disclosure would be likely to cause serious harm to the client or someone else

The serious-harm exemption is narrower than it looks. Counsellors and psychotherapists who are not HCPC-registered are not "health professionals" under the Data Protection Act 2018, so the law does not let them decide on their own judgement to withhold health information on serious-harm grounds. If you think something should be withheld, take advice first, for example from your professional body's legal helpline or your insurer.

The latter is particularly relevant if your notes contain information about third parties — for example, details a client has shared about family members. You can redact third party information before disclosure.

Write your session notes with the knowledge that your client may one day read them. Notes should be factual, professional, and avoid language you would be uncomfortable defending in a complaint.

Secure storage requirements

Digital records

Digital therapy notes should be stored in a system that is:

• Encrypted at rest and in transit
• Password protected with a strong, unique password
• Hosted in the UK, the EU or another adequate country, or covered by a valid transfer safeguard
• Subject to a Data Processing Agreement if using a third-party platform
• Backed up regularly
• Accessible only to you (or authorised practice staff)

Storing client notes in a standard Google Doc, Dropbox folder, or similar consumer service is not appropriate — these services are not designed for special category health data and are unlikely to meet UK GDPR requirements without significant additional configuration.

Paper records

If you keep paper notes, they should be stored in a locked filing cabinet in a secure location. They should not be taken home unless necessary, and should not be left in a car or other insecure location. When the retention period ends, they must be shredded — not simply placed in the recycling.

Disposing of records securely

When the retention period ends, records must be disposed of securely:

• Digital records: Permanently delete from the system and ensure any backups are also deleted. Use a platform that allows you to confirm deletion.
• Paper records: Cross-cut shredding. Confidential waste disposal services are available if you have large volumes.

Keep a record of when records are disposed of and the method used. This demonstrates compliance if you are ever audited by the ICO.

Using AI notes tools and record retention

If you use an AI notes tool like NoteSono, your records are stored on the platform. You should:

• Check where data is stored and processed (NoteSono stores notes in the EU; some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data)
• Ensure you can export records if you change platforms or close your account
• Ensure you can delete records when the retention period ends
• Factor the platform's retention and deletion policies into your overall data management

NoteSono lets you export your notes and client list as a ZIP file at any time, and delete individual notes or your entire account.

If you want a system for writing and storing your therapy notes, you can create a free account. No card needed.