A client can ask a practice to delete their personal data, but the right to erasure in Article 17 of the UK GDPR is not absolute. It does not apply where the firm must keep the data to comply with a legal obligation, such as the five year record keeping rule in the Money Laundering Regulations, or needs it to establish or defend legal claims. Most practices can therefore delete marketing data and anything held without a continuing purpose, but must refuse, with reasons, to delete the core client file until its retention period ends.

What is the right to erasure?

Article 17 of the UK GDPR gives individuals the right to have their personal data erased, sometimes called the right to be forgotten. The ICO stresses that it is not absolute and applies only in certain circumstances, and only to data held when the request is received. A request can be made verbally or in writing, to any part of the firm, and does not have to mention the law or use the word erasure. A client saying “please delete everything you hold on me” in a phone call to a junior member of staff is a valid request.

The firm must respond without undue delay and within one month of receipt. It can extend by a further two months if the request is complex or the person has made several requests, but must tell them within the first month and explain why. In most cases no fee can be charged.

When does the right apply?

The ICO lists the situations in which a person has the right to erasure. The ones that arise in practice are where:

  • the data is no longer necessary for the purpose for which it was collected;
  • the firm relies on consent and the person withdraws it;
  • the firm relies on legitimate interests, the person objects and there is no overriding legitimate interest to continue;
  • the data is used for direct marketing and the person objects; or
  • the data has been processed unlawfully.

For a former client this usually means newsletter lists, event invitations, old prospect records and duplicate copies kept after the purpose has gone. Those should be deleted when asked, and often should have been deleted already under the storage limitation principle.

Why do retention duties usually override the request?

The ICO explains that the right to erasure does not apply where processing is necessary to comply with a legal obligation, or for the establishment, exercise or defence of legal claims. Both exceptions are central for an accountancy practice.

Anti money laundering records

Regulation 40 of the Money Laundering Regulations 2017 requires a firm to keep copies of its customer due diligence documents and supporting transaction records for five years from the date it knows, or has reasonable grounds to believe, that the business relationship has ended, or that an occasional transaction is complete. Transaction records within a relationship need not be kept for more than 10 years. A client cannot override this by asking for deletion during the five years.

The same regulation works in the client’s favour afterwards. Once the period ends, regulation 40(5) requires the firm to delete personal data obtained for AML purposes unless it must keep it under another enactment or for court proceedings, the person consents, or the firm has reasonable grounds to believe the records are needed for legal proceedings. Detail is in AML record keeping.

Defending claims

Working papers, correspondence and advice records are the evidence the firm needs if a client later alleges negligence. Under the Limitation Act 1980 an action on a simple contract cannot be brought more than six years after the cause of action accrued, and section 14B sets a 15 year longstop for negligence claims not involving personal injury, counted from the act or omission. A retention policy built on those periods supports the legal claims exception; see how long practices should keep client files.

The client’s own records

A self employed client must keep business records for at least five years after the 31 January submission deadline for the tax year, and a company must keep records for six years from the end of the last financial year they relate to. Those duties fall on the client, not the firm, so they do not by themselves justify the firm keeping copies. They are, however, a good reason to return original records to the client rather than destroy them, and to remind the client of the periods in the response.

What should the firm do with data it must keep?

Keeping data is not the same as using it freely. Where a retention duty applies, the firm should restrict access to the retained file, stop using the data for anything other than the reason it is kept, and diarise deletion for the date the retention period ends. Marketing data, duplicate copies and anything with no continuing purpose should be deleted.

If erased data was disclosed to others, the ICO says the firm must contact each recipient and tell them about the erasure unless that proves impossible or involves disproportionate effort, and must tell the person who the recipients are if asked. Backups count too: if an erasure request is valid, the ICO expects the data to be put beyond use in backups even if it cannot be overwritten immediately, and the person must be told clearly what will happen to it.

Some requests come from a client the firm has reported, or is considering reporting, to the National Crime Agency. The MLRO should handle these, and the response must not reveal the suspicion; see tipping off.

How should the reply be worded?

If the firm refuses all or part of the request, the ICO says it must tell the person without undue delay and within one month, giving the reasons, their right to complain to the ICO and their ability to seek a judicial remedy. Since 19 June 2026 the person may also complain to the firm itself, and the firm must acknowledge the complaint within 30 days. A good reply:

  1. confirms what has been deleted, such as mailing list entries;
  2. lists the categories being kept, the legal reason for each and the date each will be deleted;
  3. explains that retained data will only be used for those purposes; and
  4. sets out the person’s right to complain and how.

If there is genuine doubt about who is asking, the firm may ask for proportionate information to confirm identity, and the time limit runs from when that information is received.

How might this work in practice?

Illustration only. A sole trader leaves the practice in March 2026 and on 10 October 2026 emails asking for all their data to be deleted. The firm deletes them from its newsletter list and prospect database straight away. It keeps the AML identification and verification records until March 2031, five years after the relationship ended, then deletes them. It keeps its working papers and correspondence under its written retention policy because they would be needed to defend any claim, and returns two original invoices still on file. The reply, sent on 24 October, explains each decision and the client’s right to complain.

What mistakes do firms make?

  • Deleting the AML file on request, then being unable to show a reviewer the due diligence.
  • Refusing the whole request because some data must be kept, instead of deleting what can go.
  • Missing a verbal request because it was not recognised as one.
  • Giving no reasons or retention dates in a refusal.
  • Keeping AML records indefinitely when regulation 40(5) requires deletion after the period.
  • Forgetting backups, cloud copies and the firm’s email archive.

Requests for copies, rather than deletion, follow different rules; see handling subject access requests.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.