Looking after care records
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Latest updates - 09 December 2025
09 December 2025 - this page was published
Care records contain the story of someone’s childhood. They are significant and powerful records that remain in your care for long periods of time.
Nearly half of the care-experienced people in our survey who sought access, or were seeking access to their records, were looking for records created more than 30 years ago. We’ve heard about people waiting long periods because their records were located in an inaccessible building and the distress caused by lost or accidentally destroyed records.
Your obligation is to keep them safe and secure throughout that period.

Looking after records
Throughout the period that care records are in your care, you must:
- store them securely;
- protect against loss, damage, unlawful or accidental destruction; and
- keep them up to date.
Retention periods
You must keep personal information for as long as is necessary. There are legal obligations in each part of the UK to retain care records for specified periods of time.
It is necessary to retain care records in line with these statutory obligations. You may also consider whether a longer retention period is necessary and proportionate. Several organisations working on access to care records recommend best practice retention periods for handling records. You can use these and relevant professional standards in this area, as you consider an appropriate retention schedule.
Access to records
You should ensure you have easy access to historical records and that they remain accessible throughout their retention period. You should keep a clear record of where to locate historic records that you’re responsible for. You must make reasonable and proportionate searches to locate information when someone requests it.
Lost or destroyed records
Be transparent if you’ve lost or destroyed records before you were under an obligation to keep them secure. You should make people aware of this as early as possible when handling their request for information. Where appropriate, you could do so proactively outside the subject access request (SAR) process.
Where you cannot provide records because you’ve lost or destroy them, you could provide more general information about the circumstances, where possible. For example, by providing details of the care service provider. Finding out your records have been destroyed or lost can be very distressing. Consider what support you can provide or signpost to in this situation.
Must, should, could
To help you understand the law and good practice as clearly as possible, this guidance says what organisations must, should, and could do to comply.
Legislative or legal requirements
Must refers to:
- legislative requirements within the ICO’s remit; or
- established case law (for the laws that we regulate) that is binding.
Good practice
Should does not refer to a legislative requirement, but what we expect you to do to comply effectively with the law. We expect you to do this unless there is a good reason not to. If you choose to take a different approach, you need to be able to demonstrate that this approach also complies with the law.
Could refers to an option or example that you may consider to help you to comply effectively. There are likely to be various other ways for you to comply.