BACP Record Keeping Requirements for Therapists (2026 Guide)

Keeping good clinical records is one of the core professional responsibilities for UK therapists. BACP, UKCP and the HCPC all expect practitioners to keep records — but the specific requirements, particularly around retention periods, GDPR compliance, and digital storage, are less well understood than they should be.

This guide covers what BACP expects, how long to keep records, how to store them securely, what happens when a client requests their notes, and how AI tools fit into a compliant record keeping system.

What BACP expects for clinical records

BACP's Ethical Framework and Good Practice in Action resources expect members to:

• Keep adequate, accurate records of their work with clients
• Store records securely and confidentially
• Keep records for a period they can justify after therapy ends, and destroy them securely afterwards
• Handle records lawfully under UK GDPR and the Data Protection Act 2018
• Tell clients about record keeping, for example in a privacy notice

It's also good practice to have a written retention and disposal policy.

Importantly, BACP does not require a specific note format. SOAP, DAP, BIRP, narrative — all are fine as long as notes are accurate, timely, and clinically defensible.

How long to keep therapy records

This is one of the most-asked questions in UK private practice. There is no statutory retention period for private counselling records, so the honest answer is a range:

Many practitioners keep adult records for six or seven years. Under the Limitation Act 1980, most claims for breach of contract or negligence in England and Wales must be brought within six years; personal injury claims have three years, which can start later, and for children time generally runs from age 18. If a complaint or legal claim is made, your records are your evidence, so set a period you can justify and state it in your privacy notice. For clients who were children, take advice.

What counts as a client record?

The answer is broader than most therapists assume. A client record includes:

• Session notes (SOAP, DAP, BIRP, narrative, or any format)
• Initial assessment or intake notes
• Risk assessments
• Treatment plans
• Outcome measures (PHQ-9, GAD-7, CORE-10 scores)
• Emails and messages between you and the client
• GP letters, referral letters, or correspondence with other professionals
• Consent forms and client agreements
• Invoices and payment records (also required for HMRC)

Everything on this list is personal data under UK GDPR and must be handled accordingly.

GDPR compliance for therapy records

Clinical records are special category personal data under UK GDPR Article 9 — the highest category of protection. This means additional obligations apply.

Lawful basis for processing

Most private practice therapists process client data under Article 6(1)(b) — contract performance — and Article 9(2)(h) — processing necessary for the provision of healthcare. You do not need explicit consent to keep clinical notes, but you must inform clients that you keep records.

Your Privacy Notice

UK GDPR requires you to give clients specific information about how you process their data before therapy starts. Your Privacy Notice must cover:

• What data you hold and why
• Your lawful basis for processing
• Who you share data with (supervisor, GP if risk arises, etc.)
• How long you keep records and why
• Client rights (access, correction, deletion)
• Any third-party tools you use — including AI notes tools
• Your ICO registration number

Data Processing Agreements

If you use any software to store or process client records — including AI notes tools — you need a Data Processing Agreement (DPA) with that provider. This is a legal requirement under UK GDPR Article 28. Reputable clinical software will provide a DPA automatically as part of their terms.

Where to store therapy records

Digital records must be stored in a system that:

• Has appropriate encryption in transit and at rest
• Has access controls (only you can access client records)
• Is based in the UK or a country with adequate data protection, or is covered by a valid transfer safeguard
• Has a Data Processing Agreement in place
• Allows you to export or delete records when needed

Consumer services — standard Google Drive, Dropbox, iCloud, or a generic Word document on your desktop — are generally not appropriate for special category health data without significant additional security configuration.

Purpose-built clinical record software designed for UK therapists — like NoteSono — covers much of this: storage in the EU, encryption, a DPA, and the ability to export your notes and client list or delete records at any time. Some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data.

Client access to their records

Under UK GDPR, clients have the right to request a copy of all personal data you hold about them. This is called a Subject Access Request (SAR).

Key points:

• You must respond within one month, extendable by two further months for complex requests
• You must provide copies of the personal data you hold, including session notes, based on a reasonable and proportionate search
• You can redact third-party information — details a client has shared about family members, for example
• You cannot charge for a SAR in most cases
• Write notes as if the client may one day read them: factual, professional, and defensible

If you are not HCPC-registered, you are not a "health professional" under the Data Protection Act 2018, so take advice before withholding any health information on serious-harm grounds.

Using AI for therapy notes — BACP and GDPR

AI-assisted clinical note writing has become common in UK private practice. Used carefully, it can fit both BACP's Ethical Framework and UK GDPR.

The key requirements:

• Use a tool that tells you where data is stored and processed, signs a DPA, and is ICO registered
• Ensure a Data Processing Agreement is in place with the AI tool provider
• Inform clients in your Privacy Notice that you use AI assistance for note writing
• Always review and edit AI-generated notes before saving — you remain clinically responsible
• Prefer post-session tools that don't record client audio — this significantly reduces GDPR risk

Our full guide to BACP and AI clinical notes covers this in detail, including the specific wording to include in your Privacy Notice.

What happens to records when you close your practice

This is an area many therapists don't think about until it's urgent. If you retire, close your practice, become seriously ill, or die, your client records still need to be managed.

You should have a plan that covers:

• Professional will — appoint a trusted colleague to manage records on your behalf if you are unable to
• Transfer of care — if you're closing a practice and clients are ongoing, plan how to transfer records with client consent
• Secure destruction — records that have passed their retention period should be destroyed securely (shredded for paper, permanently deleted for digital)
• Telling clients: your contract or privacy notice should explain how long you keep records and what happens to them

Record-keeping checklist

• ICO data protection fee paid
• Privacy Notice covers what data you hold, why, and how long
• Client agreement includes record keeping section
• Clinical records stored in a secure system with a DPA
• DPA in place with any third-party software
• Written retention policy with a period you can justify
• Plan for records if you are unable to practise
• Process for handling Subject Access Requests
• Notes written in professional, factual language
• Client reference codes used rather than full names

Write better notes with less time

NoteSono is designed for UK therapists who want to meet all their record keeping obligations without spending hours writing notes. Speak a short summary after your session, and NoteSono drafts a SOAP, DAP or BIRP note for you to review. Notes stored in the EU, ICO registered, DPA included.

Create a free account (free plan, no card needed)