Although this guidance refers to minimum periods for which records must be retained, there may be times when records need to be kept for longer.
Bear in mind that one of the key principles of the GDPR prohibits the retention of personal data for longer than is necessary.
Minimum length of retention of GP records
| Nation | Retention period |
|---|---|
England and Wales |
Retain for 10 years after death. For Electronic Patient Record Systems: Where the system has the capacity to destroy records in line with the retention schedule, and where a metadata stub can remain, demonstrating the destruction, then the Code should be followed in the same way for digital as well as paper records with a log kept of destruction. If the EPR does not have this capacity, then once records reach the end of their retention period, they should be made inaccessible to system users upon decommissioning. The system (along with the audit trails) should be retained for the retention period of the last entry related to the schedule. |
Northern Ireland |
Retain for 10 years after death For Electronic Patient Clinical Records developed prior to 2013 When decommissioned retain in accessible format, including the Audit Trail, for a period to be determined by the Data Controller in consultation with Clinical Specialists. Electronic Patient Clinical Records System (including the Audit Trails) developed since 2013 Records should be maintained, deleted or “put beyond use” (in line with the ICO’s guidance “Deleting Personal Data”) in accordance with a regular (at least five years) risk assessment by the Data Controller (or Joint Data Controllers). The risk assessment should be formally recorded and measured against the extant Data Protection legislation and Codes of Practice and the need to ensure effective ongoing clinical care. |
Scotland |
For the patient's lifetime and 3 years after the patient's death. Electronic records must be kept in perpetuity. |
Minimum lengths of retention of hospital records
| Type of record | Nation | Retention period |
|---|---|---|
Maternity records (including all obstetric and midwifery records, including those of episodes of maternity care that end in stillbirth or where the child later dies) |
UK |
25 years after the birth of the last child (or, in Scotland, until woman reaches age 50, whichever is longer’). |
Children and young people |
England, Wales, and Northern Ireland |
Retain until the patient's 25th birthday or 26th if young person was 17 at conclusion of treatment, or 8 years after death. |
Scotland |
Until the patient's 25th birthday, or 26th if an entry was made when the young person was 17; or 3 years after death of the patient if sooner. |
|
Mental health records |
England, Wales, and Northern Ireland |
20 years or 10 years after the patient has died (in Northern Ireland it is 8 years after death’). |
Mentally disordered persons within the meaning of any Mental Health Act |
Scotland |
20 years after date of last contact between the patient and the mental health provider. Or 3 years after the death of the patient if sooner and the patient died while in the care of the organisation. |
All other hospital records (other than non-specified secondary care records) |
England, Wales, and Northern Ireland |
8 years after the conclusion of treatment or death. |
Scotland |
6 years after last entry, or 3 years after the patient's death. |