No regulator or professional body sets a single retention period for private counselling records, and the "seven years" you will find repeated across therapy software blogs has no authoritative source behind it. BACP's own guidance points at three years. The NHS code says twenty for mental health records. Both are right, for different reasons.
This is a question where confident answers are the warning sign. If a page tells you the number without telling you where it comes from, it is guessing, and several of the pages doing that are published by practice management companies who ought to know better.
Why is there no single answer?
Because nobody with authority over private practice has set one.
The ICO's guidance on storage limitation explains that UK GDPR does not set retention periods. Personal data should be kept no longer than is necessary for the purpose it was collected for, and you should be able to justify whatever period you choose. That puts the decision on you.
BACP says as much directly. Its own guidance acknowledges that there is no simple answer to the question, and that therapists or clients who seek advice may receive very different answers.
The new BACP Ethical Framework, which members are held to from midday on 3 November 2026, does not set a period either. Its record-keeping responsibility, 3.2, requires records that are "factual, adequate and relevant for the type of service offered", stored securely and in line with "the data protection requirements of the country where the record is stored". How long you keep them is left to you. Our summary of what changed in the BACP Ethical Framework 2026 covers the rest of the new edition.
So the job is not to find the number. It is to pick a defensible period and be able to explain it.
Where does three years come from?
From the complaints window rather than from law.
BACP's position anchors on the practical point that a member may decide to retain notes for a minimum of three years from when the therapeutic relationship ended. The reasoning is that a professional conduct complaint is most likely to arrive within that period, and your notes are your defence.
That gives you a floor, not a ceiling.
Where does twenty years come from?
The NHS Records Management Code of Practice, which sets 20 years for mental health records after the patient is no longer receiving services, or eight years after death.
The important qualification, which almost nobody states, is that the NHS Code is written for NHS bodies, not for private practitioners. If you have never worked under an NHS contract, it is not your retention schedule.
It is still useful, for two reasons. It is the most considered assessment anyone in UK healthcare has made of how long mental health records stay relevant. And if you ever have to justify a long retention period, "I follow the NHS standard" is a considerably better answer than "it felt about right".
So where does "seven years" come from?
As far as we can establish, from nowhere authoritative.
The figure appears across therapy-sector software blogs stated as fact. It may have been worked back from the time limits for bringing legal claims, with a year added for comfort. Whatever its origin, we have found no authoritative source that sets it. It is not a rule, and presenting it as one is the problem.
If you have set your policy at seven years because a software company's blog said so, the period may well be fine. The justification is not, and justification is what the ICO's storage limitation guidance actually asks for.
What should you actually do?
Pick a period, write down why, and apply it consistently. Four inputs into that decision:
| Factor | What it pushes towards |
|---|---|
| Complaints window | Three years minimum from end of contact |
| Time limits for legal claims | Ask your indemnity insurer what period it expects |
| Clients who were under 18 | Longer than for adults |
| Risk of future legal proceedings | Longer, and see the note below |
Children and young people are the clearest case for a longer period. Retention guidance for the records of clients seen as children commonly runs well beyond the period used for adults. Before you set yours, check the ICO's guidance, ask your indemnity insurer what it expects, and check your professional body's position, taking professional advice if you are unsure.
Clients where proceedings are foreseeable need care. If your client's therapy relates to an assault, an accident or a family dispute, their records may be requested years later. That is a strong argument against destroying early.
Most private practices land somewhere between six and ten years from last contact for adults, and to age 25 for young people. That is defensible. So is three years, if you have thought about it and written it down.
What has to be in the policy?
Five things, and it can be one side of A4.
- The period, stated separately for adults and for clients seen as children
- When the clock starts. Almost always the end of the therapeutic relationship, not the start
- What is covered. Session notes, assessments, correspondence, contracts, invoices, and any recordings. BACP's 2026 framework (3.2(c)) expects the record to include "all communications, notes and other information held relating to clients or service users", so texts and emails with clients belong on the list
- How destruction happens. Secure shredding for paper, genuine deletion for digital, including backups
- Who is responsible, and what happens if you are not there
That last point deserves attention. Retention is a duty that falls due years after you have stopped thinking about a client, and for a sole practitioner it may fall due after you have stopped practising entirely. A clinical will, naming who takes responsibility for records if you die or become unable to work, is the mechanism the profession uses to cover it. For BACP members it becomes an explicit requirement under the 2026 framework. Core responsibility 4.5(e) requires members to "ensure we have a clinical will in place and have appointed an executor who, bound by confidentiality, can communicate with clients and service users if we are unable to contact them ourselves, or if we die." The framework calls that person the executor. Below we call them the custodian, because looking after records is the part of the job that concerns retention.
Most clinical wills are too thin to be usable. Four things make one work.
Who the custodian is, named, with current contact details, and who has actually agreed to do it. An unaware custodian is not a plan.
Where the records are, and how to get into them. For digital records that means the system, the account and the route to access it, held somewhere your custodian can reach without you.
What they are authorised to do. Respond to requests from clients, notify clients, destroy records when the retention date arrives, or hold them and do nothing until the clock runs out. Pick, and write it down.
When the job ends. The custodian's responsibility finishes when the last record is destroyed. Saying so stops an open-ended obligation landing on somebody who never agreed to one.
Supervisors and trusted colleagues are the usual choice. It is worth asking your indemnity provider whether the arrangement touches your cover, because that is the question most practitioners never think to put.
Do invoices and appointment records follow the same clock?
No, and this is where a single retention period quietly goes wrong.
Clinical records are governed by the reasoning above: professional judgement, the complaints window, and your own documented policy. Financial records are governed by HMRC, which sets a floor regardless of what your clinical policy says.
For a self-employed practitioner, HMRC requires business records to be kept for at least five years after the 31 January submission deadline of the relevant tax year. A return filed more than four years late carries its own rule: records must be kept for 15 months after you send it.
So an invoice is simultaneously a clinical record about an identifiable client and a business record HMRC can ask to see. Two consequences follow.
Do not destroy financial records on a clinical schedule. A three-year clinical retention period applied to invoices will take you below the HMRC floor.
Do not keep clinical records on a financial schedule either. The HMRC rule is a minimum for accounts, not a justification for holding session notes.
The workable answer is to separate the two in your policy. Appointment dates, fees charged and payments received are financial. What was discussed is clinical. They can live in the same system and still run on different clocks, and the erasure side of the question is why that distinction earns its keep.
Can a client make you delete their records early?
Sometimes, and less often than the phrase "right to be forgotten" suggests.
The ICO's published position is that the right to erasure does not apply where the processing is necessary for certain reasons, two of which matter here: complying with a legal obligation, and the establishment, exercise or defence of legal claims.
The ICO's own worked example on that second ground is a healthcare provider whose insurance requires patient records to be kept in case of a complaint or a claim. On the ICO's analysis, that provider can refuse an erasure request, because it is processing the data for the establishment, exercise or defence of legal claims.
Whether and how that example applies to your own practice is a question for the ICO's guidance and, where you are unsure, professional advice. What the example does show is the value of having written your reasoning down before anybody asks for it. A policy you can produce is evidence. A number you picked is not.
The procedural points are firm whichever way the answer falls:
- You must respond without undue delay and at the latest within one month of receiving the request
- Complex requests can be extended by a further two months, provided you tell the person inside the first month
- A refusal has to be explained, and partial erasure is often the right answer rather than all or nothing
- Record the request, your decision and your reasoning, which is itself part of the audit trail
The ICO notes that its guidance in this area is under review following the Data (Use and Access) Act, so check the current page before you rely on a summary, and take advice on any request you are unsure about.
Tell your clients
Retention belongs in your privacy notice and, sensibly, in your contract. Clients have a right to know how long you will hold what they told you, and a specific period reads as considered where "as long as necessary" reads as evasive.
Doing it rather than intending to
The uncomfortable truth about retention policies is that almost nobody executes them. Nobody diarises deleting a file in 2033. Paper archives become indefinite retention by default, and so do digital ones, because nothing prompts the deletion.
This is the one part of the process a system can genuinely carry. Software that records a last-contact date against every client and applies a retention rule to it turns the hardest part of compliance into a list you review. Atlacare does this with country-aware retention settings and retention-aware erasure, so a deletion request is handled against the rule rather than against a guess.
What software cannot do is choose your period. That remains a professional judgement, and writing down the reasoning is the part that makes it defensible.
The short version
Nobody sets a single number. Three years is the complaints floor. Twenty is the NHS standard, which was not written for you but is worth borrowing. Seven is folklore.
Pick your period, write down why you picked it, tell your clients, and put something in place that actually deletes when the date arrives.
Frequently asked questions
Can you give the records to the client and keep nothing?
Not as a way of discharging the obligation. Handing a client a copy is a reasonable thing to do, but your own record is what answers a complaint or a professional conduct investigation years later, and a client's copy is not available to you. Keep yours for your documented period.
If you scan paper notes, can you destroy the originals?
Yes, provided the scan is complete, legible and retrievable for the whole retention period, and the paper is destroyed securely. What matters is that the record survives intact, not which medium holds it. Check the scan before shredding rather than afterwards, and keep the digital copy backed up.
Does the retention period start when therapy ends or when the client was last seen?
At the end of the therapeutic relationship, which for most private practices is the last session or the point a planned ending was agreed. For a client who simply stops attending, the date of last contact is the usual anchor. Whichever you choose, apply it consistently and state it in your policy.
This is general information about retention obligations, not legal advice. Retention periods depend on professional body requirements, insurer expectations and the circumstances of individual clients. Take advice on any case where legal proceedings are foreseeable, and confirm the current position with your professional body.
Sources: BACP, notes and record keeping · BACP Ethical Framework for the Counselling Professions 2026 · NHS Records Management Code of Practice · ICO, storage limitation · ICO, right to erasure · GOV.UK, how long to keep your records if you are self-employed
Related: Why counsellors charge VAT when physios don't · UK GDPR for practitioners
