Guide

How long to keep therapy records

The periods below are the ones the sources we read actually state. They are not a single rule for every profession.

Updated 4 October 2026.

Information, not legal advice. This page is a practical overview for practices. It is not a substitute for advice on your own contracts, insurance or registration.

There is no single worldwide number of years for which a therapist must keep a note. UK GDPR says you keep personal data only as long as you need it for the purpose you collected it. POPIA has the same idea at its core: do not hold information longer than necessary, and tell people what you do. Professional bodies then add guidance. Some of that guidance gives a number. Some of it refuses to. This page quotes only what the sources below actually say, and links to them. It does not invent a retention period for your practice. Confirm the current document before you rely on a figure, because codes are revised.

Reviewed sources were read on 4 October 2026.

United Kingdom: BACP

The BACP Ethical Framework for the Counselling Professions (2026) says members keep appropriate records that are factual, adequate and relevant, stored securely, and compliant with the data protection requirements of the country where the record is stored. It does not, in the sections reviewed, set a fixed number of years. The PDF is BACP’s 2026 framework.

BACP’s own GDPR answers are plainer. On bacp.co.uk’s GDPR FAQ the association says data protection legislation does not set specific time limits. You keep information only as long as necessary for the purpose, and you set a retention period. It tells members to consider legal or regulatory requirements, what an indemnity insurer specifies, organisational policies, and the time limit for a complaint. It states that a complaint under BACP’s Professional Conduct procedure may be raised within three years after counselling has ended. That is a complaints window, not a sentence that says “destroy notes at three years”.

A BACP news piece of 20 March 2026, Notes and record keeping, says there is no simple answer. It says best practice is to tell clients before therapy starts whether you make notes, how long you keep them, and what happens to them. Employed therapists follow the organisation’s policy. Private practitioners set a policy that still respects data protection and their membership body. The article gives the example that a member may decide to retain notes for a minimum of three years from the end of the relationship because of that three-year complaints window. It also repeats that personal data should not be held longer than necessary, and that where no set time limit applies, the therapist decides a limit and tells clients.

So a defensible UK private-practice policy often does three things. It states a period. It explains the reason, which may include the complaints window and the insurer’s advice. It tells the client before the first session. It does not pretend BACP has issued a single mandatory number.

United Kingdom: UKCP

The UKCP Code of Ethics and Professional Practice (2019), paragraph 20, says practitioners make notes appropriate to the modality and keep records which are accurate, legible and timely. The code, in the records section reviewed, does not state a retention period. The PDF is on the UKCP site.

UKCP’s membership FAQ does give a figure, and it labels it as practice rather than as a rule of the code. The page How long should I keep client notes/records? says: “Normally, our members will retain records for 7 years, as this is suggested as general best practice.” It adds that a UKCP college or organisational member may differ, that not all modalities require notes, and that members should also ask their insurer’s legal advice team and the ICO, including because paper and electronic records can be treated differently.

If you are a UKCP member, read both documents. “Normally seven years” is what the FAQ says. It is not a licence to ignore a workplace policy that is longer, or an insurer that asks for something else, or a client who was a child.

South Africa: HPCSA Booklet 9

The HPCSA text read for this page is Booklet 9, Guidelines on the keeping of patient health records, the September 2022 version hosted at hpcsa-blogs.co.za and discussed on the HPCSA blogs page guidelines on patient record keeping. Practitioners should confirm they are looking at the current booklet on the HPCSA’s own channels. The September 2022 text says the following on retention.

Clause 7.1: patient health records should ideally be stored indefinitely, particularly if electronic storage makes that practical. If that is not practical, a record should be stored for at least a minimum of six years from the date the record becomes dormant. Dormancy starts when the patient was last treated by the practitioner.

Clause 7.2 lists exceptions. For patients under 18 when they were cared for, including obstetric care, records should be kept at least until the patient’s 21st birthday, because minors have up to three years after turning 18 to claim. For mentally incapacitated patients, records should be kept for the patient’s lifetime. Occupational health records falling under the Occupational Health and Safety Act 85 of 1993 must be kept for 20 years after treatment. For some conditions that take a long time to manifest, the text recommends not less than 25 years. Where a statute sets a period, the practitioner must comply with it.

Clause 7.3: records in a state hospital or clinic are destroyed only if the relevant Deputy Director-General authorises it. Clause 7.4 says a balance has to be struck between the cost of long retention and the risk to a practitioner’s defence, and mentions academic value and late complications.

Those are the HPCSA’s words in that text, not a software default. A South African psychology or registered-counsellor practice should not quietly adopt “three years” from a UK blog and ignore Booklet 9. The practical POPIA guide sits next to this one.

Social workers in private practice should also check the South African Council for Social Service Professions for any retention rule that applies to them. This page does not quote an SACSSP number, because a current figure was not taken from an SACSSP primary document for this review.

What to write in the contract

Whatever period you choose, within the guidance that binds you, put it in the contract and the privacy notice before you process the notes. Say when the clock starts (usually the end of therapy, or the last session). Say whether audio and transcripts are kept for a shorter time than the signed note. Say how a client can ask for a copy. BACP’s GDPR FAQ also says that if you later decide to hold data longer than you originally explained, you may need to contact clients. Do not change the period in silence.

When the period ends, delete or truly anonymise. A folder called “archive” on a laptop is not destruction. An export from clinical notes software is only as good as the deletion you do afterwards in every copy, including backups you are allowed to expire.

Children, complaints, and insurers

The sources above already contain the warnings. BACP points at a three-year complaints window as one factor. UKCP’s FAQ points at seven years as general practice and tells you to ask the insurer. HPCSA Booklet 9 points at the 21st birthday for minors and at longer periods for some other cases. If your insurer’s wording is stricter than your professional body, follow the stricter one and say so in the notice. If you do not know the insurer’s wording, ask them before you publish a number on your website.

Nothing in Reach + Within sets your retention period for you. The product can hold the record, show who opened it, and export it. The number of years is your policy, written where the client can read it, and reviewed when the code or the insurer changes.