How long must UK immigration advisers keep client records?

This page is for owners and compliance leads at organisations registered with the IAA. The six-year period is short to state and easy to get wrong in practice. The Code gives no start date. The IAA’s Guidance Notes say a copy of the file must stay with you after the original goes to the client or to another organisation. UK data protection law limits how long you keep personal data after that. We met each of these points when we built retention into Filyst, our case management product. The sections below cover the rule and who it binds, the start date, the records it covers, transfers, longer retention, destruction and a schedule to adapt.

What is the IAA rule on keeping client files and records?

Code 5.10 is the retention rule in the IAA Code of Standards 2024. It reads: “Retain all client files and records for at least six years, thereafter, securely destroying the files and records.” The rule sits under Principle 5, which requires advisers to act in the best interest of the client.

The Immigration Advice Authority is the regulator of immigration advice and services in the UK. The Immigration Services Commissioner issues the Code of Standards under paragraph 3 of Schedule 5 to the Immigration and Asylum Act 1999. The 2024 Code took effect on 1 September 2024. Work completed before that date stays subject to the 2016 Code, and paragraph 57 of the 2016 Code sets the same period of at least six years.

The Guidance Notesare the IAA’s published explanation of each Code. The Guidance Notes are not part of the Code and are not binding. The Code says an organisation that departs from them needs to be ready to explain why at a premises audit or in a complaint investigation.

Who does Code 5.10 apply to?

Code 5.10 applies to every organisation and adviser the Code of Standards applies to. The Code’s introduction says it applies to any organisation or person providing immigration advice or immigration services in the UK in relation to a relevant matter listed in section 82 of the Immigration and Asylum Act 1999.

Schedule 5, paragraph 3(3) of the Act takes three groups outside the Code:

• people authorised to practise by a designated professional body, or authorised by a designated qualifying regulator to provide immigration advice or services;
• people acting on behalf of someone in that first group;
• people mentioned in section 84(6) of the Act.

Those groups follow their own regulator’s record rules, which this page does not cover. In the Code, “organisations” covers both registered organisations and advisers, and paragraph 3(4) of Schedule 5 makes complying with the Code a duty.

Why is the retention period six years?

The IAA chose six years because most civil claims can be brought within that time. The Guidance Notes on Code 5.10 say: “The reason for this generic six-year period is because most civil claims, broadly, can be brought within a six-year period.” The file is the evidence of what the client was told and what the adviser did.

When do the six years start?

Neither the Code nor the Guidance Notes say when the six years start. The organisation has to choose a start date and apply it to every file. The date the case closes is the latest point at which the file is still being added to, so counting from it keeps every record for at least six years.

Two records the IAA already expects give that date:

• The closure letter or statement. Code 5.8 requires one when the case is concluded, when the client withdraws their instructions, or when the organisation decides to withdraw from the case.
• The client list. The Guidance Notes on Code 8.4 expect a full list of all clients that includes the date each case was opened and closed and the outcome of the matter.

Write the chosen start date into the file management system that Code 8.4 requires.

Which client files and records does the rule cover?

Code 5.10 covers “all client files and records”, on paper and electronic. The Code does not list them. The table shows the records the Code and the Guidance Notes expect an organisation to create or hold for each client.

Original documents are the one item the six-year period does not hold in your office. The Guidance Notes on Code 8.7 say originals should be retained only where necessary; otherwise copies should be made and the originals returned as soon as reasonably practicable.

Must you keep a copy after returning or transferring a file?

Yes. The Guidance Notes on Code 5.10 say: “A copy of the client’s file must be retained even if the original file is no longer held by the organisation.” The six-year requirement applies even where the records have been transferred to a new advice organisation or given to the client.

Two Codes send a file out of the organisation:

• Code 5.7requires the return of all documents relating to the client’s case when requested and without delay. The guidance adds that the organisation must keep a copy of the client’s file for its own records in accordance with Code 5.10.
• Code 5.9 requires the transfer of the file and all documents where the client requests it, as soon as possible and without prejudice to the client, irrespective of whether any payment is outstanding. The transfer goes to the client or to another organisation, as the client requires. The guidance says it should normally happen within three working days from receipt of notification that the instructions have ended, unless that is impracticable.

The same guidance says an organisation cannot hold on to a client’s documents in lieu of fees owed.

Can you keep client records longer than six years?

Yes, with a recorded reason. Six years is a minimum. The Guidance Notes say that where an organisation feels it is necessary to retain files beyond six years, the Commissioner expects an attendance note detailing its reasoning for further retention, kept with the files.

Data protection law is the limit on the other side. UK GDPR Article 5(1)(e), the storage limitation principle, requires personal data to be kept “for no longer than is necessary for the purposes for which the personal data are processed”. The Guidance Notes say registered organisations must comply with current data protection legislation.

The Information Commission is the UK data protection regulator; it took over from the Information Commissioner on 30 September 2026 and still publishes at ico.org.uk as the ICO. Its guidance on storage limitation says UK GDPR does not dictate how long to keep personal data and that the organisation has to justify the period. Code 5.10 and its stated reason are that justification for the first six years. Where personal data is collected from the client, Article 13(2)(a) also requires the organisation to tell the client the storage period, or the criteria used to set it, which is normally done in the privacy notice.

How should client records be destroyed after six years?

Code 5.10 requires secure destruction and does not prescribe a method. The Guidance Notes say the client file and associated electronic data should be securely deleted or destroyed.

• Paper. The Guidance Notes on Code 8.6 say an organisation holding paper records will need a shredder, and that organisations can outsource the secure destruction of files.
• Electronic records.The ICO’s storage limitation guidance says that where personal data is deleted from a live system, it should also be deleted from any back-up of that system.
• Staff. The Guidance Notes on Code 4.5 expect all staff to know how to dispose of confidential material securely, including electronic data.

What goes in a retention and destruction schedule?

A retention and destruction schedule is a list of files showing which have been retained and which destroyed. The Guidance Notes recommend that organisations keep one. The IAA publishes no set format, so the columns below are our starting point to adapt, not an IAA form.

1. Client name and file reference.
2. Date the case was opened.
3. Date the case was closed, and the date of the closure letter.
4. Start date of the retention period under your policy.
5. Earliest destruction date: the start date plus six years.
6. Original file transferred or returned: to whom and on what date, with confirmation that a copy was kept.
7. Reason for keeping the file longer than six years, with the date of the attendance note that records it.
8. Date destroyed, method, and the person who authorised it.

What happens if a firm does not follow Code 5.10?

A failure to meet a Code will in most cases result in the Principle being found in breach, the Code of Standards says. A serious failure to meet the standards may result in regulatory action, and a failure can be serious in isolation or as part of a persistent pattern.

The IAA reviews an organisation’s work at premises audits and through complaint investigations. A file destroyed early cannot be produced at either, and Code 8.6 requires client records to be available to the Commissioner upon request. The IAA audit checklist lists closure letters and retention among the evidence to have ready for Principle 5.

Retention is one of ten Codes under Principle 5, and it depends on the records the other Codes create. The IAA Code of Standards guide sets out all nine Principles that Code 5.10 belongs to.

How did we handle retention when building Filyst?

We set the start date to the day a case is closed, because the Code leaves that choice open and a closing date is one the system already records. Filyst is our own case management product for immigration firms. It starts a retention period when a case closes, which is 72 months by default for UK firms.

Filyst then reminds the case owner when destruction is due, and it blocks destruction before the period has ended. The reminder does not destroy anything. A person decides whether a file has a recorded reason to be kept longer. Case management software for immigration firms describes the rest of what Filyst records for each case.

Frequently asked questions

Sources

1. IAA, Code of Standards 2024 (PDF)
2. IAA, Code of Standards 2024: Guidance Notes (PDF)
3. IAA, Code of standards (publication page, effective dates)
4. OISC, Code of Standards 2016 (PDF)
5. Immigration and Asylum Act 1999, Schedule 5, legislation.gov.uk
6. UK GDPR Article 5 (principles), legislation.gov.uk
7. UK GDPR Article 13 (information to be provided), legislation.gov.uk
8. ICO (Information Commission), Principle (e): Storage limitation
9. Data (Use and Access) Act 2025, section 118 (abolition of the office of Information Commissioner), legislation.gov.uk