How long must therapists keep client notes in Ireland?

This is the GDPR question therapists ask most often and the one with the least satisfying answer, because the rule that actually governs it is not a data protection rule at all.

How long must therapists keep client notes in Ireland?

The IACP recommends seven years from the last date of service delivery for adult clients, and retaining records for children and young people until they are 25, or 26 if they were 17 when sessions ended. GDPR sets no figure at all; the limitation period does.

Why GDPR does not give you a number

People expect GDPR to specify a retention period. It does the opposite. The storage limitation principle says personal data must not be kept longer than necessary for the purpose it was collected for, and then leaves "necessary" to you.

So the question becomes: what would make it necessary to still hold notes about someone you last saw six years ago? The answer is almost always the possibility of a complaint or a claim. If you are called to account for your practice, your notes are your evidence, and a therapist who destroyed them on schedule can find they have destroyed their own defence.

That is why the limitation period, not the regulation, sets the floor. A personal injury claim in Ireland must generally be brought within two years of the date of knowledge, and a contract claim within six, so a seven-year retention period sits just beyond the longer of the two.

The minor client complication

The part that catches people out is clients seen as children. For a claim arising from work with a minor, the limitation clock does not begin until they turn eighteen, which is why the IACP recommendation is expressed as an age rather than a duration: hold until 25, or 26 if they were 17 when the work ended. A therapist who saw a twelve-year-old is therefore looking at thirteen years, not seven.

If you work with young people at all, this needs to be an explicit line in your retention policy rather than something you work out later.

What your professional body says matters more than what you decide

Accrediting bodies publish records guidance, and it is generally more specific than the law. If you are accredited, that guidance is effectively your standard: a complaint will be assessed against it, and "I used a shorter period than my body recommends" is a difficult position to hold.

Check your body's current guidance directly rather than relying on a summary, including this one. The IACP guidelines quoted here are version 2.1, and these documents get revised.

The IACP also says explicitly that some insurers require longer retention than it recommends, so the binding number may be in your policy rather than in the guidelines. That is worth checking once rather than assuming the professional-body figure is the ceiling.

What a retention policy actually needs to say

Four things, written down before you need them:

• How long, for adult clients, from last date of service.
• Until what age, for clients seen as minors, since this is an age rather than a duration.
• What happens at the end: secure destruction, and what "secure" means for the format you hold them in.
• Where they live in the meantime, and who else can reach them.

The last one is the one most often missing. A retention period is meaningless if the notes are in a filing cabinet in a room you gave up two years ago, or in a cloud account nobody but you can access if something happens to you.

Deletion is not always the safe option

There is an instinct that deleting sooner is more privacy-respecting and therefore safer. It is not, and the asymmetry is worth understanding.

Holding notes for the appropriate period is lawful and expected. Destroying them early, and then facing a complaint, leaves you both undefended and open to a second criticism about your record-keeping. Over-retention is a data protection problem; under-retention is a professional one, and the professional one tends to bite harder.

Access requests do not change the retention period

A client asking for their notes is exercising a right of access. Complying with that request does not mean you then delete your copy: you still need the record for the same reasons you needed it before. Access and erasure are separate rights, and erasure is not absolute where you have a legitimate reason to retain.

What to do this week

Write the policy down. Put the two periods in it, adult and minor. Say where the notes live and how they are destroyed. Check it against your professional body's current guidance rather than against a blog post.

Then make sure your website's privacy policy says the same thing, because a client who reads one and is told another has found a real inconsistency.

Getting the website side of that consistent with how you actually work is part of what we set up.