Robust record management strategies are crucial for law firms, given the sheer volume of sensitive documents they handle, including agreements, instructions, and case notes. Effective and compliant document management also includes prescription periods on how long firms should retain client matter files. Please note that this is a requirement of the UK GDPR.
It is generally accepted that most types of records should be retained for a minimum of five years as per the Prescription and Limitation (Scotland) Act 1973. This is the primary negative prescription period under short negative prescription, though certain legal documents require more extensive retention periods, and sometimes more. This is more complex than it first may seem due to a variety of factors.
Below, our compliance team have provided some recommendations on prescription period guidelines and constructive document retention policies.
General Guidance on File Retention Periods
From the moment sensitive documents are created, firms are regulated on how they are handled.
The following should be considered:
- The Law Society of Scotland Accounts Rules give the regulatory guidance on the storage of accounting records. Firms are required to retain accounting records for ten years from the date of the matter closure. Files should not be destroyed before this time.
- The AML Regulations 2017 require firms to retain Client Due Diligence (CDD) documents for a total of five years. This applies across all UK jurisdictions, including Scotland.
- Where the primary period for professional negligence is five years from the date on which the pursuer first became, or could reasonably have become, aware of the loss (under the Prescription (Scotland) Act 2018 discoverability provisions), Master Policy insurers are likely to ask firms to retain records for a minimum of six years as a prudent buffer. Please note that it is not uncommon for claims to arise at or after the primary five-year prescription period has expired.
- Both children and clients under the Adults with Incapacity (Scotland) Act 2000 fall into the category of persons under legal disability. Please note that the usual rules on prescription do not apply to such persons. The prescription period for children will not begin to run until the child reaches the age of 16, in accordance with the Age of Legal Capacity (Scotland) Act 1991. Therefore, provision needs to be made for persons under this category as they will need to be treated differently.
- Once the firm has established the agreed retention period with the client, the client must be given the right to have their data deleted. The client can exercise this right any time after the minimum retention period, regardless of whether they have reached an agreement with the firm to store the file for longer or not.
- Most firms will have extended periods of retention as agreed with the client on a case-by-case basis. When we draft policies, we set the standard for six years, but ask the firm to identify other types of matters where they may need to store the file for longer. For example:
- Wills – by agreement with the client and if the firm is instructed to hold for life
- Powers of Attorney – to be held while the Power of Attorney is live, particularly where the firm is appointed as attorney (including an additional six years from closure), in accordance with the Adults with Incapacity (Scotland) Act 2000
- Trusts – as the above and for as long as the Trust is live, plus six years
- Firms should also remain mindful that under the Prescription and Limitation (Scotland) Act 1973, the long negative prescription extinguishes obligations after twenty years. This is the outer limit within which claims can arise. Firms handling complex or high-value matters should consider whether an extended retention period of up to twenty years is appropriate and should agree this with the client accordingly.
To comply with the requirements under the regulations set by the Law Society of Scotland, a minimum retention period of five years suffices for most records, noting that accounting records require ten years under the Accounts Rules. Retaining files beyond the minimum offers protection in the event of an allegation of negligence, with periods ranging from six to twenty years, depending on the matter type. In some instances, an extended period is agreed upon with the client.
Policies & Procedures
Advising clients on how long you will retain their files is essential. This information should be included in the client information letter (or terms and conditions), in compliance with the Law Society of Scotland’s Practice Rules 2011 (as amended). It should outline what will happen to the file afterwards, for example, whether the file will be destroyed or returned to the client after a certain period.
An up-to-date document retention policy is essential when managing and protecting important records. Without one, firms may face sanctions or financial penalties resulting from poor data management practices. The data retention policy must explain the firm’s approach and cross-reference into UK GDPR statements and client information documentation.
It remains the firm’s decision as to whether they wish to store data for longer, but this will need to be agreed with the client, and the reasons for this approach will need to be provided too. Failure to inform a client on:
- how long their data will be stored,
- the timeframe in which it will be deleted, and
- the opportunity to request deletion
…would be a breach of the regulations. Not deleting the data at the time the firm has agreed to would also constitute a breach.
Ultimately, the firm’s terms and conditions need to communicate clearly what the storage and retention policy is. Due to the reasons explained above, it cannot be less than five years, and must meet the ten-year requirement for accounting records under the Law Society of Scotland Accounts Rules. Our recommendation is that the standard policy is set at six years, or extended by agreement with the client. For matters where loss or negligence may only be discovered after the primary prescription period, firms may consider extending their storage up to twenty years.
Please note that all of the above refers to both electronic and paper files. If you store documents in an electronic format, you should consider whether the absence of paper documents will be detrimental to the client’s interests before you agree on such storage methods with your client.
Procedures Management & Effective Policies
A firm’s failure to maintain an updated suite of documents that accurately reflects its operations and staff responsibilities can leave it vulnerable to criticism from Master Policy insurers and the Law Society of Scotland. To avoid these risks, firms should consider implementing the following:
- Rather than relying on generic templates that may not accurately represent how the firm works, use bespoke documentation and procedures tailored to the firm’s specific needs and operations.
- Regularly monitor and maintain documentation to ensure it accurately reflects the firm’s everyday practices.
- Provide training to relevant staff members on new or updated procedures to ensure they are properly implemented.
The Regulation & Compliance Office provides quality and bespoke document drafting in consultation with the firm. RACO works with firms to generate bespoke documents that reflect how they operate, and will help establish best practices and implementation of any changes, so that the policies always match the firm’s workings.
Outsourced Compliance Solutions
Our goal is to ensure the firms we work with have and maintain a compliant structure, enabling them, their managers, and owners to focus on serving their clients.
Our packaged risk and compliance solutions provide guidance and support to firms on a range of topics, including:
- Our Regulation and Compliance Service, including Risk Management and AML Risk, provides firms with the necessary Policies, Controls and Procedures (PCPs) alongside training, supervision structure, an annual independent assessment and reporting. This solution ensures that firms and their staff are compliant and remain so. It also clarifies what to do in the event of a breach.
- Our extended service, Regulation & Compliance Outsource Guidance & Support, provides an outsource solution for firms where RACO not only manages and maintains the risk registers and provides guidance to all staff, including partners, but also produces monthly risk and compliance reports.
The combination of these two solutions provides a law firm with a robust, cost-effective risk and compliance strategy that ensures staff have access to expert guidance when needed.
The Regulation & Compliance Office
We work with law firms and professional indemnity insurers, advising and guiding on compliance and risk management techniques to assist and reduce instances of claims or regulatory breaches.
We offer a range of services and consultancy tailored to the legal sector, with specialist knowledge of Scottish regulatory requirements. We have gained a wealth of knowledge and experience in the overall management of law firms across multiple jurisdictions, and work with them to achieve profitability, stability, and efficiency. Our goal is to consistently provide high-quality services and solutions.
For more information about The Regulation & Compliance Office, you can call us on 0203 985 8550 or email us at: info@regulationandcomplianceoffice.co.uk
