Print and File Retention Under SRA Requirements

Ask ten practice managers how long the SRA says a client file must be kept and several will give a firm answer. Most of those answers will be common practice rather than a regulatory rule. Retention in a law firm is built from a patchwork of specific record keeping duties, limitation periods, insurer and lender requirements and data protection law. Printing and scanning touch every part of it.

This guide separates what the rules actually say from what firms typically do. It then looks at the print side of retention that is easy to overlook: scanning paper files, the logs your print management system keeps, data held on devices and the secure destruction of paper at the end of the period.

This is general information, not legal advice. Retention periods depend on the matter type and your own circumstances. Your COLP, risk team or professional adviser should approve your firm’s retention policy.

What the SRA does and does not require

There is no single SRA rule that sets one retention period for every client file. The Law Society’s practice advice service says there is no specific Law Society guidance fixing how long a closed file should be stored either. Instead it points firms to relevant statutory provisions such as limitation periods, to lender requirements in the UK Finance Mortgage Lenders’ Handbook where they apply and to the terms of the firm’s professional indemnity insurance. It also says firms should tell clients how long their file will be kept and what will happen to it afterwards.

Some records do carry specific minimum periods. The SRA Accounts Rules require accounting records to be stored securely and kept for at least six years. The Money Laundering Regulations 2017 require customer due diligence records to be kept for five years after a business relationship ends or an occasional transaction completes, after which personal data in them should normally be deleted unless another legal basis applies. Your duty of confidentiality under the SRA Code of Conduct continues throughout, including while files sit in storage.

Why six years is common but not universal

Many firms adopt six years after matter closure as their baseline because it broadly matches the ordinary limitation period for claims in contract and tort. A file kept for that period is available if a former client later brings a claim. Longer periods are common for work where problems surface late. Where negligence only comes to light later, the latent damage rules in the Limitation Act 1980 can extend the time for a claim up to a longstop of 15 years from the negligent act. That is why property, private client and some commercial files are often retained longer. Wills, trusts, lasting powers of attorney and matters involving children are frequently kept much longer again.

The opposite pressure comes from UK GDPR. Under the storage limitation principle in Article 5(1)(e), data that identifies people must not be held for longer than the purpose requires. A policy of keeping everything forever is no safer than destroying files too early. The aim is a documented period for each type of matter with a reason for it.

Scanning paper files into the matter record

Scanning is often the most practical way to reduce storage costs and apply a retention policy consistently. A scanned file sits in the case or document management system where closure dates, review dates and deletion can be managed centrally rather than box by box in an off site store.

• Decide which originals must be kept. Wills, deeds, powers of attorney and documents that may be needed in original form as evidence should not be destroyed just because they have been scanned.
• Scan to a consistent standard. Searchable PDFs at a sensible resolution, checked for missing pages before any paper is destroyed.
• File to the matter. Scans should go straight into the correct matter so they inherit its retention period.
• Record what was done. Keep a note of who scanned the file, when and what happened to the paper.

Firms planning large back file scanning projects sometimes look to BS 10008, the British Standard on the evidential weight and legal admissibility of electronic information, as a framework for their procedures.

Print logs are records too

Print management software keeps a log of every job. Depending on settings that log can include the user name, the device, the time, page counts, the client and matter code and often the document title. A title such as a client’s name followed by a description of the dispute is personal data in its own right. The log is therefore something the firm should cover in its retention policy rather than leave to software defaults.

There is a balance to strike. Logs support billing, cost reporting and investigation of incidents such as a misdirected document. They do not need to be kept for as long as the files themselves. Many firms settle on a period long enough to cover billing queries, audits and any accreditation review, then have older log data removed automatically. Some print management platforms also allow document titles to be hidden or anonymised in reports, which reduces the personal data held.

• Agree a log retention period and record the reason for it.
• Configure automatic removal of older job data in the print management system.
• Limit who can view detailed logs to finance, IT and compliance roles.
• Include print logs in the firm’s record of processing activities.

Data held on devices and in the cloud

Multifunction devices can hold copies of scanned and printed images on internal storage. Held print jobs sit on a server or in a cloud service until they are released or deleted. Neither location should become an accidental archive. Set devices to overwrite stored images, set held queues to delete uncollected jobs after a short period and make sure any cloud print service used by the firm has clear data retention terms in its contract.

When a device leaves the building at the end of a contract its storage should be wiped or removed and destroyed, with a certificate of data destruction for your records.

Destroying paper securely at the end of the period

When a file reaches the end of its retention period, destruction should be deliberate and recorded. Before destroying anything, check that no original documents belonging to the client remain on the file and that no complaint, claim or regulatory matter requires it to be kept. Use cross cut shredding or a confidential waste contractor working to a recognised standard such as BS EN 15713 and obtain a certificate of destruction listing the files covered.

The same discipline applies day to day. Spare copies, misprints and working drafts are not part of the retained file. They should go into locked confidential waste consoles rather than general recycling.

A practical retention checklist for print and scanning

• Write retention periods by matter type with a reason for each.
• Tell clients how long their file will be kept in your terms of business.
• Scan to the matter and keep originals where needed.
• Set retention for print logs and held jobs, not just files.
• Destroy paper through a certified process and keep the certificates.

If you would like scanning, print logging and device data handling set up around your retention policy, our Managed Print Services for Legal Firms page explains how CopyBox Document Systems configures print services for legal practices.

More guidance on confidentiality, data protection and secure print for solicitors is collected in the Legal Firm MPS Guidance section of our site.

Good retention is a mix of clear policy and devices that do what the policy says. To make sure your scanning, print logs and device data follow your rules, visit our Managed Print Services for Legal Firms page or call our Bedford team.