This is general information, not legal advice. Retention rules depend on your country, your profession and sometimes your professional body. Check your national law and your professional association’s guidance before you set your own periods.

The two rules you have to reconcile

GDPR storage limitation. Article 5(1)(e) GDPR says personal data must be kept in a form that identifies the person for no longer than is necessary for the purpose it was collected for. Therapy notes are health data, a special category under Article 9, so the bar for justifying long retention is, if anything, higher. GDPR itself does not give you a number of years; it asks you to decide one and be able to explain it.

National retention duties. Many countries set a minimum period for health records in their healthcare, patient-rights or civil law. Where such a duty exists, it gives you the legal basis to keep the record and, in practice, sets the floor for your retention period. GDPR also recognises this: the right to erasure in Article 17 does not apply where you have to keep the data to comply with a legal obligation.

Put simply: national law usually tells you the minimum, GDPR tells you not to go far beyond it without a reason.

Two national examples

To show how different the numbers can be, here are two examples. They are illustrations, not a complete overview, and the rules have conditions and exceptions that may change — always check the current rules for your situation.

Country	Rule	Period	Note
Netherlands	WGBO (Medical Treatment Contracts Act)	20 years	For healthcare providers covered by the WGBO, counted from the last change to the record. Check your national rules.
Germany	BGB §630f	10 years	After the treatment has ended, unless other rules require a longer period. Check your national rules.

Two things stand out. First, the difference between countries is large — a factor of two in these examples alone. Second, whether a rule applies to you can depend on your profession. A rule written for healthcare providers may or may not cover a counsellor or a coach, and a regulated psychologist may have extra duties under their professional code. If you are unsure which category you fall into, your professional body is usually the quickest place to ask.

When there is no national rule

If you work in a country or a profession without a specific statutory period, you still need to decide one. A reasonable approach looks like this:

Start from your professional body’s guidance. Many associations publish a recommended retention period in their ethics code or record-keeping guidance.
Consider why you might need the record later. Common reasons are a returning client, a complaint, or a legal claim. The time limits for complaints and claims in your country are a sensible reference point.
Treat minors separately. Records about children are often kept for longer, for example until some years after the client reaches adulthood. Check whether your country or professional body sets a specific rule.
Write the period down with your reasoning. Under the accountability principle you should be able to explain why you chose it.

Not every document has the same clock

A client file is not one thing. Different parts of it can — and often should — have different retention periods.

Session notes and assessments

The core clinical record. Usually covered by any national health-record retention duty.

Agreements and consents

The therapy agreement and GDPR consent show what the client agreed to. Keep them at least as long as the record they relate to.

Invoices and payments

Governed by tax and accounting law, not health law. The period is set nationally and is often different from the clinical record.

Booking enquiries and messages

Contact details from someone who enquired but never became a client rarely need to be kept long. Delete them once they have served their purpose.

Invoices are a good example of why a single “keep everything for X years” rule rarely works. Your accountant will know the tax retention period in your country, and it is usually not the same as the clinical one.

Writing a simple retention policy

You do not need a long document. One page in your records of processing activities (Article 30) is usually enough for a solo practice. Include:

Each category of data you keep: clinical notes, agreements, invoices, enquiries, correspondence.
The retention period for each, and the legal rule or reasoning behind it.
The trigger that starts the clock — for example the end of treatment or the date of the invoice.
How and when you review files that have reached the end of their period, for instance once a year.
How you delete: what happens to the record in your software, on paper and in any backups or exports.

Telling clients matters too. Your privacy notice or therapy agreement should say how long you keep their record. If you have not written that notice yet, our GDPR guide for therapists walks through what it needs to cover.

Common retention mistakes

Keeping everything forever “just in case”, with no written period at all.

Deleting clinical notes when a client asks, without checking whether a national retention duty applies first.

Forgetting copies: exported PDFs, email attachments and old laptops still hold client data.

Using one period for every document instead of separating clinical, financial and enquiry data.

Not knowing which rule applies to your profession because you never asked your professional body.

Long retention means long-term security

Keeping records for ten or twenty years is not just an administrative task. For that whole period you are responsible for keeping them secure under Article 32 GDPR, and if they are ever exposed, Article 33 gives you 72 hours to notify your supervisory authority. A record that sits in an old inbox or on a forgotten USB stick is a risk for every one of those years.

Encrypted at rest, readable only by you

In PRAXINGO, client data is end-to-end encrypted with a key derived from your encryption password. PRAXINGO cannot read it, and a recovery key protects you if you forget the password.

One place for the whole file

Notes, signed documents with their audit log, appointments and invoices sit together, so you are not hunting through separate tools when a file reaches the end of its period.

Notes you can find again

Pin and tag notes so an access request under Article 15 or a handover does not start with a search through months of sessions.

Read more about the encryption model on our security page, see every feature, or compare plans on pricing. If you are assessing software right now, the data processing agreement checklist covers what to ask a provider about deletion and retention.

Frequently asked questions

A former client asks me to delete their file. Must I?

Not always. If a national law requires you to keep the record, the right to erasure does not override it. Explain this to the client, delete anything not covered by the duty, and record the request and your answer. Some national rules give clients a specific right to have records destroyed despite the retention period — in the Netherlands, for example, the WGBO lets a client ask for their file to be destroyed — so check yours.

When does the retention period start?

Not at the first session. Depending on the rule, the clock starts at the end of treatment or at the last change to the record (the Dutch WGBO uses the latter), so the exact trigger depends on the rule that applies to you. Write the trigger into your retention policy.

What happens to my records if I close my practice?

Your retention duties continue after you stop practising. Plan who will hold the records, how clients can reach them and how they will be deleted at the end. Many professional bodies have guidance on this.

Keep client records safe for as long as you need them

End-to-end encrypted notes, documents and invoices in one place — readable only by you.

Start free trial

14-day free trial · no credit card required

How long should therapists keep client records in Europe?