Behaviour analysis record keeping: what should a practice retain?

Define the complete case record

UK-SBA registrants are expected to document work sufficiently for review, accurate provision and handover, including assessments and outcomes, plans and revisions, notes and case data. A record should show why work began, what was agreed, the authority or consent in place, assessments, plans in force, service delivery, data, decisions, material communications and closure or transfer.

Common categories are referral and intake, identity and authority, agreement and fees, consent and permissions, assessments and baseline, plans and version history, session notes and raw data, reviews, material communications, restricted safeguarding or complaint records, billing, and closure. Not every email belongs permanently in the case file. Keep communications that materially affect delivery, consent, risk, plans, decisions, attendance or handover.

Retention is not a universal number

The ICO is explicit that the UK GDPR does not dictate a single period. Set standard periods or criteria where possible, review retained information, and erase or anonymise it when it is no longer needed. Do not say that every record is retained for seven years because GDPR says so.

A schedule should identify the category, purpose, trigger, normal retention period or review point, rationale, end action, owner and any deletion hold. Different triggers might be an unsuccessful enquiry closing, formal case closure, final invoice, complaint resolution or departure of a worker. A period without a trigger is incomplete.

Consider claims, access and deletion together

Retention may be justified for professional review, complaints, insurance or legal claims, but information with no possible relevance should not stay forever “just in case”. Do not guess limitation periods, particularly for children or personal injury. Ask an insurer or solicitor about the specific evidence and period relevant to the practice.

Pause normal deletion for an active SAR, complaint, investigation, safeguarding process or actual or reasonably anticipated legal proceedings. Record who applies and releases the hold. Erasure is not absolute: assess the category, purpose, lawful basis, exceptions and continuing need rather than promising immediate deletion or permanent retention.

Deletion is more than moving a case to an archive. Archived identifiable information remains personal data. Plan disposal across live systems, shared drives, recycle bins, backups and processors. Do not promise instant removal from every backup if the technical model is controlled expiry. Pseudonymised information is normally still personal data; anonymisation must genuinely prevent identification.

Make retained records retrievable

SARs can be verbal or written and normally require a response within one month. The ICO expects reasonable and proportionate searches. Define the authoritative record, attachment and recording locations, captured material communications, access permissions, archive state and review date. A retention policy that cannot locate a record is not reliable governance.