Help for therapists - what is GDPR data retention and how long should client data be kept for?

GDPR Data Storage and Retention for Therapists Data

UK Data Protection laws, including the UK General Data Protection Regulation (GDPR) and UK Data Protection Act (DPA) create a lot of legal obligations for therapists when using personal data, such as client data.

One of the key legal principles is the limited duration of storage for personal data, often known as GDPR data retention.

That is, how long personal data can legally be stored for.

Data retention is only one aspect of the many data protection obligations, including other principles and documentation obligations. To find out more, buy Practical GDPR for Therapists from Amazon.

What is GDPR Data Retention and Storage Limitation?

UK Data Protection laws require that data is only stored for as long as is really necessary.

This article outlines regulations relating to the retention of personal data for therapists in the UK.

The law essentially says that you can keep personal data for as long as the regulator (the ICO) deems reasonable, for the purpose the data was collected for.

Unfortunately, the regulator doesn't tell us how long they deem reasonable.

The purposes for retaining data may include your original purpose for legitimate business, to fulfil a legal obligation, or to protect yourself from legal claims.

Therapists should document their planned retention periods, ideally within their Records of Processing Activities (RoPA) document, and also establish technologies and procedures to anonymise (if made transparent to the data subject) or delete personal data, once the end of the retention period ends.

You also need to consider and document when the retention period starts. E.g. 6 months from the client's last session.

This article is written by a data protection specialist, but is not formal legal advice. Data protection laws are nuanced, and you should seek advice for your own processing if required.

Why does GDPR Data Retention Matter?

Failure to comply with data protection legislation can result in prosecution or fines from the regulator, and potentially legal action from the data subjects such as your clients.

Retaining data that you don't need isn't likely to directly get you in to trouble, but if there is a data breach, or if a client complains to the ICO, it can increase any fines you may get.

Protecting clients' data is an important way to protect your client.

If the regulator does take action against a company, they often post that on their website, so your business could also be at risk of reputational damage which might put future clients off.

To access the rest of this article, please login or join as a Pro level member.

Access the professional member area for details about how long personal data should typically be kept for.