Keep copies of every EICR, EIC and Minor Works certificate you issue for at least six years, which covers the six-year limitation period for contract claims under the Limitation Act 1980 and HMRC's record-keeping period. Landlords in England must keep an EICR until the next inspection is due under the Electrical Safety Standards in the Private Rented Sector (England) Regulations 2020 and hand a copy to the next inspector. Because certificates carry names, addresses, signatures and often photographs of someone's home, they are personal data under UK GDPR: you need a lawful basis to hold them, secure storage, and in most cases a data protection fee paid to the Information Commissioner's Office (ICO).
- No single law sets a retention period; six years is the practical minimum and many keep EICs for the life of the installation.
- Landlords in England must keep the EICR until the next one is due and give a copy to the next inspector; councils can fine up to £30,000.
- Certificates are personal data under UK GDPR; the lawful basis is usually performance of a contract or a legal obligation.
- Deletion requests can be refused where the certificate is needed for legal obligations or claims; reply within one month.
How long should an electrician keep electrical certificates?
No regulation says "keep an EICR for X years". The period comes from several separate rules; keep the certificate for as long as the longest applies.
| Record | Driver | Practical retention |
|---|---|---|
| EICR | Client relies on it for compliance; scheme assessment; potential claims | At least 6 years; longer if you inspect the same property again |
| EIC | Records the installation as built; needed by the next inspector; Part P evidence | Life of the installation, or at least 6 years |
| Minor Works certificate | Records an alteration; Part P evidence where notifiable | At least 6 years |
| PAT test records | IET Code of Practice recommends comparison with previous results; Electricity at Work Regulations 1989 evidence | Several years; at minimum the previous result for each item |
| Invoices and job records | HMRC | 6 years (companies); 5 years after the 31 January filing deadline (self-employed) |
The six-year logic
The Limitation Act 1980 gives six years from the breach for a claim in contract and, for most negligence claims, six years from the damage. A client who alleges a certificate was wrong can bring a claim years after you issued it, and the certificate, schedule of test results and your job notes are your defence. Personal injury claims have a three-year limit from the date of injury or knowledge, but the injury may occur long after the work.
Scheme rules and EICs
Competent-person schemes such as NICEIC and NAPIT expect a registered business to produce recent certificates at the annual assessment; see How to become NICEIC registered. An Electrical Installation Certificate (EIC) is the record of how a new installation or circuit was designed, built and tested, and BS 7671 expects it to be kept with the installation for the next inspector, so many electricians keep every EIC indefinitely.
How long must a landlord keep an EICR?
In England, the Electrical Safety Standards in the Private Rented Sector (England) Regulations 2020 require the landlord to obtain an EICR at least every five years, give a copy to the tenant within 28 days, supply it to the council within seven days if asked, and keep it until the next inspection is due for the next inspector. Councils can fine up to £30,000, so a landlord who has lost the report has a problem. See EICR landlord requirements 2026 and, for Scotland and Wales, EICR landlord requirements in Scotland and Wales. Landlords and agents will come back to you for copies, sometimes years later.
What personal data does an electrical certificate contain?
Personal data is any information relating to an identifiable living individual. A typical certificate holds:
- The client's name, address and often phone number or email.
- The installation address, which identifies the occupier.
- The landlord's or agent's name, and sometimes the tenant's.
- The inspector's name and signature.
- Observations describing conditions inside a home ("extension lead under carpet in living room").
- Photographs of rooms and defects, which can show belongings and occasionally people.
Photographs deserve particular care: they can be sensitive if they show medical equipment or religious items, and should be limited to what the report needs. None of this stops you holding the data; it means you must do so on a lawful basis, keep it secure, and be able to explain what you hold and why.
What is the UK GDPR lawful basis for holding certificates?
UK GDPR requires a lawful basis for every processing activity. For certificates, three apply:
| Lawful basis | When it applies |
|---|---|
| Performance of a contract | You were instructed to inspect or install and certify; producing and keeping the certificate is part of doing the job |
| Legal obligation | Part P notification records; landlord EICRs that the client must obtain by law; records required by the Electricity at Work Regulations 1989 |
| Legitimate interests | Retaining certificates beyond the contract to defend claims, satisfy scheme assessment and provide copies on request |
You do not need consent to hold a certificate, and asking for it is a mistake because consent can be withdrawn and the certificate cannot. A one-page privacy notice on your website or quote, naming the basis for each type of record, does the job for a sole trader. Marketing is separate: an EICR reminder to past customers is a legitimate interest under the Privacy and Electronic Communications Regulations provided they can opt out; cold marketing to tenants you met on a job is not.
Does an electrician need to register with the ICO?
Almost always, yes. Under the Data Protection (Charges and Information) Regulations 2018, every organisation or sole trader that processes personal data must pay the ICO's data protection fee unless exempt, and the exemptions (staff administration, accounts, marketing, or data not held on computer) rarely cover an electrician who keeps client details and certificates in an app or on a laptop. The fee is tiered by size and modest for a micro business; the ICO publishes current figures and a self-assessment tool. Not paying when you should is a fixed penalty. The fee registers you; it does not audit you.
How should certificates be stored securely?
UK GDPR Article 5 requires personal data to be kept secure against unauthorised access, loss and destruction. For a small electrical business that means:
- Certificates in a system with individual logins and strong passwords.
- Device encryption on phones, tablets and laptops.
- Backups, so a broken phone does not lose a year of certificates.
- Access limited to people who need it; paper copies locked away and old pads shredded.
A breach that risks people's rights, such as a stolen unencrypted laptop, must be reported to the ICO within 72 hours.
Can I share certificates with letting agents, tenants and buyers?
Sharing a certificate with the person who instructed the work is performance of the contract; where the landlord instructs you through an agent, the agent gets the report. Giving the tenant a copy is the landlord's obligation, but sending it directly at the landlord's request is fine. Other requests need a moment's thought:
| Who asks | What to do |
|---|---|
| Letting agent who instructed you | Send it |
| New letting agent for the same landlord | Confirm with the landlord or ask the agent for the landlord's authority, then send |
| Tenant | Send if the landlord has agreed; otherwise point them to the landlord, who is legally obliged to provide it |
| Another electrician doing the next EICR | Send with the client's agreement; it is what BS 7671 expects |
Send by a secure route: a client portal, an expiring link or a password-protected PDF, particularly for reports full of interior photographs.
What if someone asks me to delete their data?
The right to erasure under UK GDPR Article 17 is not absolute. It does not apply where data is held to comply with a legal obligation or to establish, exercise or defend legal claims, which a certificate is, so you can decline to delete the certificate itself. Delete what you no longer need: marketing contact details, duplicated photographs, old quotes. Respond within one month, in writing, saying what you deleted and why the rest is retained. The same one-month deadline applies to a subject access request for a copy of all the personal data you hold about someone.
How Certio helps
Certio produces the EICR, EIC, Minor Works certificate and PAT records on the BS 7671 model forms and turns them into branded PDFs. Photograph the consumer unit and the circuit schedule drafts itself; point the phone camera at a Megger MFT-X1 and the reading goes straight into the schedule of test results, or dictate it while your hands stay on the probes. Suggested observation wording with the regulation reference is there for you to check and confirm. The judgement stays yours; the typing goes. Starter is free for 7 days, then £5 a month.