Guide · Records
Record keeping in private practice: what BACP, UKCP and HCPC expect
Therapy records in UK private practice should be accurate, timely, secure and limited to what is necessary. That is the common ground of the HCPC standards, the BACP Ethical Framework and UK GDPR. None of them sets a template; they set principles, and you choose a routine that meets them.
- HCPCFull, clear, accurate, prompt, secure
- BACPAdequate, relevant, limited to what is necessary
- RetentionNo statutory period found
- AccessClients can ask for their records
What the professional bodies say
| Body | What it says | Checked |
|---|---|---|
| HCPC | Standard 10: keep "full, clear and accurate records", complete them "promptly and as soon as possible" after providing a service, and protect them "from loss, damage or inappropriate access". | Read on 12 October 2026 |
| BACP | Commitment 2e: "keeping accurate and appropriate records". Good Practice point 15: records that are "adequate, relevant and limited to what is necessary for the type of service being provided" and comply with data protection requirements. | Read on 12 October 2026 |
| UKCP | UKCP publishes a Code of Ethics and guidance on security and confidentiality. | Unverified Content not read |
HCPC standards apply to registrants such as practitioner psychologists and arts therapists. BACP and UKCP apply to their members and registrants. If you belong to more than one body, meet the stricter expectation.
What UK GDPR adds
- Retention. The ICO is clear that "the UK GDPR does not set specific time limits". You decide, document the period in a retention policy and must be able to justify it.
- Security. Health information needs appropriate protection: access control, encryption on devices, secure disposal.
- Access. Clients can ask for a copy of their personal data, which includes your notes. Write every entry as if the client might read it.
- Necessity. Record what you need for the service. Long verbatim accounts or third-party details are rarely needed.
How long to keep records
Unverified We found no statutory retention period for adult therapy records in UK private practice. Some indemnity insurers suggest around seven years after the end of therapy for adults, and longer for children. Bupa's terms ask recognised therapists to be able to store client records securely for more than seven years. Write your period down, give a reason, and review it.
A record-keeping routine that holds up
- Write the note on the day of the session, with the date and session number.
- Record attendance, cancellations and non-attendance separately from content.
- Enter questionnaire scores with instrument, raw score and date.
- Link entries to the goals in the treatment plan where you can.
- Record consent decisions: what was agreed, with whom, when.
- Correct mistakes with a dated addition rather than deleting text.
- Close the case with an end-of-therapy summary.
Where software fits
Many therapists use a practice management system as their record. Report Copilot is different: it is a drafting tool for documents such as insurer reports and GP letters, and it is not a record system. Your clinical record stays where your professional body expects it to be.
Frequently asked questions
Do I have to keep records at all?
HCPC registrants must keep records under standard 10, and BACP's Ethical Framework commits members to keeping accurate and appropriate records. If you practise without records, check your professional body and indemnity terms.
How long should I keep adult therapy records?
UK GDPR sets no fixed period. Some indemnity insurers suggest around seven years after therapy ends for adults, which we have not verified; Bupa asks recognised therapists to be able to store records for more than seven years. Document your own period and the reason.
Are my personal process notes part of the record?
If they relate to an identifiable client, they are likely to be personal data and could be within a subject access request. Keep only what you need and treat them as part of the record.
Can I keep records on my laptop?
Yes, if they are protected appropriately: encrypted device, strong password, screen lock, backups you control and secure disposal at the end of the retention period.
Sources
- HCPC: Standards of conduct, performance and ethics, standards 5 and 10: hcpc-uk.org
- BACP: Ethical Framework for the Counselling Professions, Commitment 2e and Good Practice point 15: bacp.co.uk
- Information Commissioner's Office: Storage limitation: ico.org.uk
- Bupa: Terms and conditions for Bupa recognised mental health therapists, updated February 2020 (PDF): bupa.co.uk
- Unverified UKCP Code of Ethics (2019) and Security and Confidentiality Guidelines: psychotherapy.org.uk. Indemnity insurers' retention advice was not checked against a primary source.
First published . Last reviewed . General information, not legal or clinical advice. Check the current rules of your insurer, professional body and the ICO before relying on it. Written by the PsyClinicAI team. Corrections: support@psyclinicai.com.