How long should you keep client consent forms?

There are two separate questions and they get conflated constantly. The first is a records requirement: some regulators specify that consent records for tattooing or body piercing must be retained for a set period, and inspectors may ask to see them.

The second is the limitation period - how long somebody has to bring a claim about something that happened at that appointment. That period is often longer, and it is the one that determines when a consent form stops being useful to you.

Keeping records to the shorter of the two clocks is a common and expensive mistake.

In many jurisdictions a limitation period for a minor does not begin until they reach the age of majority. A piercing done on a fifteen-year-old may be actionable well over a decade later.

The practical implication is that guardian consents should be kept substantially longer than adult ones - and that a retention policy based on the appointment date alone will discard exactly the records most likely to be needed.

Keeping everything forever is not a neutral choice. Consent forms contain health information, dates of birth, contact details and often identity documents, and privacy regimes including GDPR expect personal data not to be kept longer than necessary for the purpose it was collected for.

The resolution is a stated, defensible policy rather than either extreme. Write down how long you keep records and why, apply it consistently, and be able to delete an individual client's personal details on request while retaining an anonymised record that the treatment and consent existed.

Storage is not the constraint it once was. A decade of digital consent forms is a rounding error, whereas a decade of paper is a room.

The real requirement is retrievability. A record you cannot find within a few minutes, eighteen months later, by client name, is functionally the same as a record you did not keep.