How Long Should You Keep Counselling Records After a Client Leaves?

There is no legal retention period for private counselling records, and the "seven years" you will find repeated across therapy software blogs has no authoritative source behind it. BACP's own guidance points at three years. The NHS code says twenty for mental health records. Both are right, for different reasons.

This is a question where confident answers are the warning sign. If a page tells you the number without telling you where it comes from, it is guessing, and several of the pages doing that are published by practice management companies who ought to know better.

Why is there no single answer?

Because no statute sets one for private practice.

UK GDPR does not specify retention periods. It requires that personal data is kept no longer than is necessary for the purpose it was collected for, and that you can justify whatever period you choose. That principle is called storage limitation, and it puts the decision on you.

BACP says as much directly. Its own guidance acknowledges that there is no simple answer to the question, and that therapists or clients who seek advice may receive very different answers.

So the job is not to find the number. It is to pick a defensible period and be able to explain it.

Where does three years come from?

From the complaints window rather than from law.

BACP's position anchors on the practical point that a member may decide to retain notes for a minimum of three years from when the therapeutic relationship ended. The reasoning is that a professional conduct complaint is most likely to arrive within that period, and your notes are your defence.

That gives you a floor, not a ceiling.

Where does twenty years come from?

The NHS Records Management Code of Practice, which sets 20 years for mental health records after the patient is no longer receiving services, or eight years after death.

The important qualification, which almost nobody states, is that the NHS Code binds NHS bodies. It does not bind a private practitioner. If you have never worked under an NHS contract, it is not your retention schedule.

It is still useful, for two reasons. It is the most considered assessment anyone in UK healthcare has made of how long mental health records stay relevant. And if you ever have to justify a long retention period, "I follow the NHS standard" is a considerably better answer than "it felt about right".

So where does "seven years" come from?

As far as we can establish, from nowhere authoritative.

The figure appears across therapy-sector software blogs stated as fact. It looks back-derived from the Limitation Act 1980, which sets a general six-year limitation period for contract and tort claims, with a year added for comfort. That is a reasonable piece of reasoning. It is not a rule, and presenting it as one is the problem.

If you have set your policy at seven years because a software company's blog said so, the period may well be fine. The justification is not, and justification is what UK GDPR actually asks for.

What should you actually do?

Pick a period, write down why, and apply it consistently. Four inputs into that decision:

Factor	What it pushes towards
Complaints window	Three years minimum from end of contact
Limitation Act claims window	Six years, longer for personal injury
Clients who were under 18	Until at least their 25th birthday
Risk of future legal proceedings	Longer, and see the note below

Children and young people are the clearest case for a longer period. A client who was 16 during therapy has until well into adulthood to bring a claim, because limitation periods generally do not start running against a child until they turn 18.

Clients where proceedings are foreseeable need care. If your client's therapy relates to an assault, an accident or a family court matter, their records may become evidence years later. Our guide to police and court requests for therapy notes covers what happens when that request arrives, and it is a strong argument against destroying early.

Most private practices land somewhere between six and ten years from last contact for adults, and to age 25 for young people. That is defensible. So is three years, if you have thought about it and written it down.

What has to be in the policy?

Five things, and it can be one side of A4.

The period, stated separately for adults and for clients seen as children
When the clock starts. Almost always the end of the therapeutic relationship, not the start
What is covered. Session notes, assessments, correspondence, contracts, invoices, and any recordings
How destruction happens. Secure shredding for paper, genuine deletion for digital, including backups
Who is responsible, and what happens if you are not there

That last point deserves attention. Retention is a duty that falls due years after you have stopped thinking about a client, and for a sole practitioner it may fall due after you have stopped practising entirely. A clinical will, naming who takes responsibility for records if you die or become unable to work, is the mechanism the profession uses to cover it.

Tell your clients

Retention belongs in your privacy notice and, sensibly, in your contract. Clients have a right to know how long you will hold what they told you, and a specific period reads as considered where "as long as necessary" reads as evasive.

Doing it rather than intending to

The uncomfortable truth about retention policies is that almost nobody executes them. Nobody diarises deleting a file in 2033. Paper archives become indefinite retention by default, and so do digital ones, because nothing prompts the deletion.

This is the one part of the process a system can genuinely carry. Software that records a last-contact date against every client and applies a retention rule to it turns the hardest part of compliance into a list you review. Atlacare does this with country-aware retention settings and retention-aware erasure, so a deletion request is handled against the rule rather than against a guess.

What software cannot do is choose your period. That remains a professional judgement, and writing down the reasoning is the part that makes it defensible.

The short version

There is no legal number. Three years is the complaints floor. Twenty is the NHS standard, which does not bind you but is worth borrowing. Seven is folklore.

Pick your period, write down why you picked it, tell your clients, and put something in place that actually deletes when the date arrives.

This is general information about retention obligations, not legal advice. Retention periods interact with limitation law, professional body requirements and the circumstances of individual clients. Take advice on any case where legal proceedings are foreseeable, and confirm the current position with your professional body.

Sources: BACP, notes and record keeping · NHS Records Management Code of Practice · ICO, storage limitation · Limitation Act 1980