A cabinet and a laptop full of old clients
You have been in practice for years. There is a filing cabinet of paper notes from clients you last saw a long time ago, a laptop folder with hundreds of client documents, and a practice system full of closed records. Your privacy notice mentions a retention period. You have never actually applied it.
Deleting feels risky because you are not sure which records are past their date, and doing it by hand would take weeks. So everything stays, and the pile grows every year.
Why nothing gets deleted
Retention needs one fact about every client: the date their file effectively closed. Most practices do not record that anywhere. Without it, every deletion decision means reading the file to work out when you last saw them.
- Closure is not recorded; clients just stop coming.
- Records are split between paper, a laptop, email and a practice system.
- Some records need to be kept longer for reasons specific to that client, and those are not flagged.
- Deleting from one system while copies remain in another gives a false sense of having done it.
- There is no log, so you could not show what was deleted and when.
The cost of keeping everything
| Risk | Why it matters |
|---|---|
| More data to protect | A lost device or breach exposes years of records rather than current ones |
| Promises in your privacy notice not kept | Your stated retention period is not what happens |
| Records requests get bigger | More to search and review when a former client asks |
| Storage and clutter | Paper cabinets and full drives that nobody wants to touch |
| Decisions made in a rush | A clear-out done in one go, later, with less care |
What your retention period should be is for your professional body, insurer and adviser to guide. The operational problem is applying whatever period you choose.
How we put your retention policy into practice
- A closure date on every record. Where the practice system shows a last session, we use it. For older files, we build a list from diaries and invoices for you to confirm.
- Your retention periods as rules, including any categories that need longer, and a way to put a hold on any individual record with a reason.
- A monthly review list of records that have reached the end of their period, which you approve before anything happens.
- Deletion or archive across every connected system in one step, with a check that copies in email and document storage are covered.
- A deletion log: which client reference, which systems, when, and on whose approval, without keeping the content itself.
- A process for paper: the review list includes paper files with their location, so you can shred them and tick them off.
Nothing is ever deleted without your approval. The system prepares the list; you make the call.
The first pass over years of old records is the heavy one, and we plan it carefully with you. After that, the monthly list is usually short.
After the first review
Each month, a short list of records appears. You glance at it, hold any that need keeping, and approve the rest. The log records what was done. Your practice holds what your policy says it should, and nothing more.
The laptop folder and the old cabinet stop being a nagging worry, because there is finally a process for them.
How to know it is time
- You have never deleted old client records.
- Your privacy notice states a retention period you do not apply.
- You do not record when a client's file closed.
- Records for one client exist in several places.
- You could not show what was deleted and when.