Robust record management strategies are crucial for law firms. This is because of the sheer volume of sensitive documents they handle, including agreements, instructions, and case notes. Effective and compliant document management also includes limitation periods on how long firms should retain client matter files. Please note that this is a requirement of the UK GDPR.

It is usually accepted that most types of records should be retained for a minimum of six years as per the Limitation Act of 1980. This is the primary limitation period, though certain legal documents require more extensive retention periods of at least 15 years, and sometimes more. This is more complex than it first may seem due to a variety of factors.

Below, our compliance team have provided some recommendations on limitation period guidelines and constructive document retention policies.

General guidance on file retention periods

From the moment sensitive documents are created, firms are regulated on how they are handled. The following should be considered:

• The accounts rules give the regulatory guidance on the storage of records. This is six years from the date of the matter closure. File should not be destroyed before this time.
• The AML Regs 2017 says firms must retain Client Due Diligence (CDD) documents for a total of five years.
• Where the primary period for professional negligence is six years from the date of the breach/loss) insurers are likely to ask firms to retain records for seven years in view of the Limitation Act. Please note that it is not uncommon for claims to arise immediately after the 6-year limitation period has expired.
• Both minors and clients under the Mental Capacity Act 2005 fall into the category of persons under a disability. Please note that the usual rules on limitation here do not apply. For example, the limitation period for minors will not begin to run until the child reaches the age of 18. Therefore, provision needs to be made for persons under this category as they will need to be treated differently.
• Once the firm has established with the client that they cannot destroy records within six years, the client must be given the right to have their data deleted. The client can do this any time after the six years, regardless of whether they have reached an agreement with the firm to store the file for longer or not.
• Most firms will have extended retention periods, as agreed with the client on a case-by-case basis. When we draft policies, we set the standard for seven years, but we ask the firm to list other matters where they may need to retain the file longer. For example,
  • Wills – by agreement with the client and if the firm is instructed to hold for lifeLPA’s – again to be held while the LPA is live, particularly where the firm is appointed (including an additional seven years from closure)
  • Trusts – as the above and for as long as the Trust is live + seven years

• Firms should also stay mindful of the fact that Section 14b of the Limitation Act, which allows for claims in negligence to extend to fifteen years. Please be aware that this will only apply when the negligence is discovered at a later point in time, but cannot exceed fifteen years, and is limited to three years from the date of knowledge.

Lastly, to comply with the Solicitors Regulation Authority (SRA) regulations, a minimum six-year retention period is required. Anything beyond this will be protection in the event of an allegation of negligence with periods ranging from seven to fifteen years. In some instances, an extended period is agreed upon with the client.

Policies & Procedures

Advising clients on how long you will retain their files is essential. This information should be included in the client care letter (or terms and conditions). It should outline what will happen to the file afterwards. For example, you may include details on whether the file will be destroyed or returned to the client after a certain period.

An up-to-date document retention policy is essential when managing and protecting important records. Without one, firms may face sanctions or financial penalties resulting from poor data management practices. The data retention policy must explain the firm’s approach and cross-reference to GDPR statements and client care documentation.

It remains the firm’s decision as to whether they wish to store data for longer, but this will need to be agreed with the client, and the reasons for this approach will need to be provided too. Failure to inform a client on:

• how long their data will be stored,
  • the timeframe in which it will be deleted, and
  • the opportunity to delete it

…would be a breach of the regulations. Not deleting the data at the time the firm has agreed to would also constitute as a breach.

Ultimately, the firm’s terms and conditions need to communicate clearly what the storage and retention policy is. Due to the reasons explained above, it cannot be less than six years. Our recommendation is it should be set at seven years or extended by agreement with the client. Other firms may choose for matters where knowledge may be realised after the primary limitation period to extend their storage for up to fifteen years.

Please note that all the above refers to online and paper files. If you store documents in an electronic format, you should consider whether the absence of paper documents will be detrimental to the client’s interests before you agree on such storage methods with your client.

Procedures Management & Effective Policies

A firm’s failure to maintain an updated suite of documents that accurately reflects its operations and staff responsibilities can leave it vulnerable to criticism from professional indemnity insurers and regulatory bodies. To avoid these risks, firms should consider implementing the following:

• Rather than relying on generic templates that may not accurately represent how the firm works, use bespoke documentation and procedures tailored to the firm’s specific needs and operations.
• Regularly monitor and maintain documentation to ensure it accurately reflects the firm’s everyday practices.
• Provide training to relevant staff members on new or updated procedures to ensure they are properly implemented.

The Regulation & Compliance Office provides quality and bespoke document drafting in consultation with the firm. RACO works with firms to generate bespoke documents that reflect how they operate, and will help establish best practices and implementation of any changes, so that the policies always match the firm’s workings.

Outsourced Compliance Solutions

Our goal is to ensure the firms we work with have and maintain a compliant structure, enabling them, their managers, and owners to focus on serving their clients.

Our packaged risk and compliance solutions provide guidance and support to firms on a range of topics, including:

• Our Regulation & Compliance Service inc. Risk Management & AML Risk provides firms with the necessary Policies Control and Procedures (PCP’s) alongside training, supervision structure, an annual independent assessment and reporting. This solution ensures that firms and their staff are compliant and remain so. It also clarifies what to do in the event of a breach.
• Our extended service, Regulation & Compliance Outsource Guidance & Support, provides an outsource solution for firms where RACO not only manages and maintains the risk registers and provides guidance to all staff, including partners, we also produce monthly risk and compliance reports.

The combination of these two solutions provides a law firm with a robust and cost-effective risk and compliance strategy that ensures staff have access to expert guidance as it is needed.

The Regulation & Compliance Office

We work with law firms and professional indemnity insurers, advising and guiding on compliance and risk management techniques to assist and reduce instances of claims or regulatory breaches.

We offer a range of services and consultancy tailored to the Legal sector. We have gained a wealth of knowledge and experience in the overall management of law firms, and work with them to achieve profitability, stability, and efficiency. Our goal is to consistently provide high-quality services and solutions.

For more information about The Regulation & Compliance Office, you can call us on 0203 985 8550 or email us at: info@regulationandcomplianceoffice.co.uk