Keep your copy of every EICR, EIC and Minor Works certificate for at least six years. That is the minimum NICEIC's scheme rules set for certificates, and it matches the six-year limit for contract claims under the Limitation Act 1980. For work in dwellings completed after 28 June 2022, keep it for 15 years, because the Building Safety Act 2022 stretched Defective Premises Act claims to that length. Certificates carry names, addresses, signatures and photos of people's homes, so they are personal data under UK GDPR: you need a lawful basis, a stated retention period, secure storage and, for most firms, the ICO data protection fee of £52 a year.
- Six years is the floor. NICEIC's scheme rules require certificates and other records to be kept for a minimum of six years, and a contract claim can be brought for six years under the Limitation Act 1980.
- Fifteen years is the safer figure for domestic work. Work on a dwelling completed after 28 June 2022 can be the subject of a Defective Premises Act claim for 15 years from completion.
- No statute gives the electrician a retention period for an EICR. In England the duty to keep it until the next inspection sits with the landlord, backed by penalties of up to £40,000.
- Certificates are personal data. The lawful basis is contract and legitimate interests, not consent.
- Most firms pay the ICO data protection fee: £52 a year for a micro business, with a penalty of up to £4,350 for not paying.
- You can refuse to delete a certificate, but you must answer the request within one month.
- Since 19 June 2026 every business that handles personal data needs a way to take data protection complaints and must acknowledge them within 30 days.
How long should an electrician keep electrical certificates?
No regulation says "keep an EICR for X years". The answer is built from scheme rules, limitation periods, tax law and data protection law, and each record is kept for as long as the longest of those applies to it.
| Record | What drives the period | Keep your copy for |
|---|---|---|
| EIC or Minor Works certificate for work in a dwelling | Defective Premises Act 1972, scheme rules, Building Regulations evidence | 15 years from completion |
| EIC or Minor Works certificate for commercial or industrial work | Limitation Act 1980, scheme rules | 6 years minimum; 12 if the contract was signed as a deed |
| EICR | Scheme rules, claims over the report, repeat requests for copies | 6 years minimum; many keep 15 so one rule covers everything |
| Schedules, photos and site notes behind a certificate | They are the evidence for the certificate | Same as the certificate |
| PAT (in-service inspection and testing) records | HSE guidance that test records are kept through the working life of the equipment | 6 years for your copy; the client keeps theirs for the life of the equipment |
| Instrument accuracy and calibration records | They prove the readings on a certificate came from an instrument in check | Same as the certificates they support |
| Complaints about the technical standard of work | Scheme rules | 6 years minimum |
| Invoices, CIS and VAT records | HMRC | 5 years after the 31 January deadline if self-employed; 6 years for companies and for VAT |
If you want one rule that never catches you out, keep everything attached to a certificate for 15 years and everything financial for six. Digital storage costs next to nothing, and the difference between digital and paper certificates shows most clearly when someone asks for a copy from eight years ago.
Why is six years the floor and 15 the safer figure?
Because a certificate is your evidence, and you need it for as long as someone can bring a claim about the job. In England and Wales the time limits look like this.
| Type of claim | Time limit | Runs from | Source |
|---|---|---|---|
| Breach of an ordinary contract | 6 years | The breach, in practice completion of the job | Limitation Act 1980, section 5 |
| Breach of a contract signed as a deed | 12 years | The breach | Limitation Act 1980, section 8 |
| Negligence causing property damage or financial loss | 6 years, or 3 years from when the claimant could have known, capped at 15 years | The damage, the knowledge, and for the cap the negligent work | Limitation Act 1980, sections 2, 14A and 14B |
| Personal injury | 3 years | The injury, or the date the injured person knew of it | Limitation Act 1980, section 11 |
| Defective Premises Act, new dwelling | 15 years | Completion | Section 1, for claims arising after 28 June 2022 |
| Defective Premises Act, work on an existing dwelling | 15 years | Completion | Section 2A, for work completed after 28 June 2022 |
Section 2A is the one that changed things for domestic electricians. It was added by the Building Safety Act 2022 and applies to anyone who, in the course of a business, takes on work on a building that contains a dwelling. The duty is to do the work in a professional manner, with proper materials, so that the dwelling is fit for habitation as far as that work is concerned. A rewire, a board change or a new circuit in a house or flat is work of exactly that kind.
A worked example: you replace a consumer unit in a semi and issue the EIC on 3 March 2023. A contract claim runs out on 3 March 2029. A Defective Premises Act claim can be started until 3 March 2038. The retention date for that EIC, its schedule of test results and your photos of the finished board is therefore March 2038, not March 2029.
Two further points. Personal injury has no long stop: someone hurt by a defect 20 years after the work still has three years from the injury, which is why many electricians keep EICs for the life of the installation. And Scotland runs on different law, with a five-year prescription period and a 20-year long stop under the Prescription and Limitation (Scotland) Act 1973, and no Defective Premises Act.
What do NICEIC and the other schemes expect you to keep?
NICEIC's scheme rules (the version dated July 2026) require a registered business to maintain records "for a minimum of 6 years or longer if contractually agreed", and they list specifications, certificates, competence records and complaints as examples. Assessors can ask to see duplicates of every certificate and report you have issued, and the rules also call for records showing the consistency and ongoing accuracy of your test instruments.
That last one matters more than it looks. A certificate from 2022 is only as good as your ability to show the instrument was reading true at the time, so the calibration certificate and your monthly checkbox readings belong in the same archive as the certificates. If you are with another scheme, read its own rules rather than assuming NICEIC's figure; the differences between them are covered in NICEIC vs NAPIT. For what the assessor asks for on the day, see how to become NICEIC registered and Qualified Supervisor sign-off explained.
What does BS 7671 say about who keeps the certificate?
BS 7671 deals with who receives the certificate, not how long the contractor stores it. Chapter 64 requires the Electrical Installation Certificate, with its schedules, to be given to the person ordering the work, and Chapter 65 does the same for the condition report. The retention advice is on the model forms themselves, in the guidance for recipients:
- On the EIC, the original "should be retained in a safe place and be shown to any person inspecting or undertaking further work on the electrical installation in the future".
- On the EICR, the person ordering the report should have the original "and the inspector should have retained a duplicate".
So the standard assumes two copies exist for the life of the installation: the client's and yours. IET Guidance Note 3 tells the next inspector to ask for previous certificates and reports before starting, and where none exist the inspection needs more investigation and the report needs wider limitations. That is the practical reason clients ring you years later. See EICR sampling and limitations explained for how missing records change the extent of an inspection.
One more retention rule follows from the standard moving on. BS 7671:2018+A4:2026 was published on 15 April 2026 and Amendment 2 is withdrawn on 15 October 2026, so your archive will hold certificates issued to different editions. Keep each one exactly as issued, naming the edition it was issued to. Never regenerate an old certificate on a newer form: the record is of what you certified on the day, to the standard in force on the day. The three documents are compared in EICR vs EIC vs Minor Works.
How long must a landlord keep an EICR, and what will they ask you for?
In England the Electrical Safety Standards Regulations 2020 put the retention duty on the landlord. The landlord must:
- give a copy of the report to each existing tenant within 28 days of the inspection;
- give a copy to a new tenant before they move in, and to a prospective tenant within 28 days of a written request;
- send a copy to the local housing authority within seven days of a written request;
- keep a copy until the next inspection and give it to the person carrying out that inspection;
- get written confirmation that any remedial or investigative work has been done, and pass it to the tenant and the council within 28 days of completion.
Councils can impose a financial penalty of up to £40,000 for a breach. The regulations now cover social housing as well as private lets, with existing social tenancies brought in from 1 May 2026, and social landlords must also have electrical equipment they supply inspected and tested, which puts a statutory duty behind those PAT records.
What this means for you: landlords and agents lose reports, change agents and sell portfolios, and they come back to the electrician for a copy. Keep the EICR and the remedial paperwork (the EIC, Minor Works certificate or written confirmation) together as one set per property, because the council asks for both. The full duties are in landlord EICR regulations in England and landlord EICRs in Scotland and Wales, and the follow-up sequence is in unsatisfactory EICR: what happens next.
What personal data is on an electrical certificate?
Personal data is any information relating to an identifiable living person. A typical certificate holds:
- the client's name, address, email and phone details;
- the installation address, which identifies the occupier even when the client is a landlord or agent;
- the landlord's and agent's names, and sometimes the tenant's;
- the inspector's and Qualified Supervisor's names and signatures;
- observations that describe conditions inside a home, such as an extension lead run under a bedroom carpet;
- photographs of rooms, boards and defects, which can show belongings, post, family photos and occasionally people.
Photographs need the most care. A picture of a damaged socket that also shows medical equipment or a child's bedroom says more about the household than the report needs. Frame the defect, not the room, and attach only the photos that support an observation. Good observation wording does the same job in text: Electrical Safety First's Best Practice Guide 4 codes the defect, not the occupier, and how to write EICR observations shows wording that describes the installation without commentary on the people living with it.
None of this stops you holding the data. It means you are a data controller, and you must be able to say what you hold, why, and for how long.
What is the UK GDPR lawful basis for keeping certificates?
UK GDPR Article 6 requires a lawful basis for each thing you do with personal data. Three cover an electrician's records.
| Lawful basis | What it covers |
|---|---|
| Performance of a contract | Taking the client's details, doing the inspection or installation, producing the certificate and sending it to the person who ordered it |
| Legal obligation | Duties that fall on you: Building Regulations notification through your scheme, and HMRC, CIS and VAT record keeping |
| Legitimate interests | Keeping certificates after the job to defend claims, satisfy scheme assessment and supply copies on request |
You do not need consent to hold a certificate, and asking for it is a mistake: consent can be withdrawn, and you cannot hand back your evidence. Note also that a landlord's legal duty to obtain an EICR is the landlord's obligation, not yours. Your basis for keeping your copy is legitimate interests.
Tell people what you do in a short privacy notice on your website, quote or terms: who you are, what you collect, the basis, how long you keep it, and how to contact you or complain.
Marketing is separate. An email or text reminding a past customer that their EICR is due is direct marketing under the Privacy and Electronic Communications Regulations. You can send it to a previous customer without fresh consent under the "soft opt-in", provided you collected the details during a sale or quote, you are marketing your own similar services, and every message offers a simple way to opt out. A tenant you met while testing a landlord's property is not your customer, so the soft opt-in does not reach them.
How do you justify keeping personal data for 15 years?
UK GDPR Article 5 says personal data must be kept no longer than necessary for the purpose. It sets no figures. You choose the period and must be able to justify it, and a limitation period that runs for 15 years is a sound justification for keeping the evidence for 15 years.
What the storage limitation principle really bites on is everything else. Keep the certificate set, and clear out what has no continuing purpose:
- quotes that never became jobs, after a year or two;
- duplicate and unused site photos, when the certificate is issued;
- contact details held only for marketing, when the person opts out;
- copies sitting in email attachments, phone galleries and messaging apps once the certificate is filed properly.
Write the periods down. A half-page retention schedule that you actually follow is all a small business needs.
Does an electrician need to pay the ICO data protection fee?
Most do. Under the Data Protection (Charges and Information) Regulations 2018, a business that processes personal data electronically pays an annual fee to the Information Commissioner's Office unless it is exempt.
| Tier | Who it covers | Annual fee | By direct debit |
|---|---|---|---|
| 1, micro | Turnover up to £632,000 or no more than 10 staff | £52 | £47 |
| 2, small and medium | Turnover up to £36 million or no more than 250 staff | £78 | £73 |
| 3, large | Everyone above tier 2 | £3,763 | £3,758 |
The exemptions are narrow. They cover firms that process personal data only for staff administration, advertising and marketing of their own business, and accounts and records, plus anyone working purely on paper. A one-man firm that holds customer details only to do the job and invoice it may come out exempt; a firm with CCTV on its unit or yard for crime prevention will not. The ICO's online self-assessment takes a few minutes and gives a definite answer. Keep a screenshot of the result.
The penalty for not paying when you should is up to £4,350, and paying the fee puts your business on the public register that commercial clients and letting agents sometimes check. Being exempt from the fee does not exempt you from the rest of the law.
What changed in 2026 under the Data (Use and Access) Act 2025?
Two changes reach a small electrical business.
First, since 19 June 2026 a new section 164A of the Data Protection Act 2018 requires every controller to have a process for data protection complaints. You must make it easy to complain, acknowledge a complaint within 30 days, look into it without undue delay and tell the person the outcome. For a sole trader this is two lines in the privacy notice: an email address for complaints, and a statement that you will acknowledge within 30 days and that the person can go to the ICO if they are not satisfied.
Second, the Act confirms that a subject access request calls for a reasonable and proportionate search, not a trawl of every device you have ever owned, and that the one-month clock can pause while you ask the requester to clarify what they want.
How should certificates be stored securely?
UK GDPR requires "appropriate" security, which scales with the size of the business. For an electrician that means:
- certificates held in a system with individual logins, strong passwords and two-step sign-in where it is offered;
- a screen lock and encryption on every phone, tablet and laptop, with remote wipe switched on;
- a backup that does not live on the same device, tested by actually restoring a file;
- access limited to the people who need it, and removed the day someone leaves;
- paper pads and printed duplicates locked away, and shredded at the end of their retention period;
- a written agreement with any software provider that stores certificates for you, because the provider is your data processor and the law requires a contract covering how it handles the data.
If something goes wrong, you have 72 hours from becoming aware of a personal data breach to report it to the ICO, where the breach is likely to put people at risk. A stolen unencrypted laptop full of landlord reports is reportable. A lost phone that was locked, encrypted and wiped remotely is unlikely to be, but write down what happened and what you did, because you are expected to keep a record of every breach whether reported or not.
Who can you send a copy of a certificate to?
Send it to whoever ordered it. Everyone else needs the client's agreement, and an email saying "yes, send it" is enough.
| Who asks | What to do |
|---|---|
| The client or the agent who instructed you | Send it |
| A new letting agent for the same landlord | Get the landlord's confirmation by email, then send |
| The tenant | Send if the landlord agrees; otherwise refer them to the landlord, who has the legal duty to provide it |
| A buyer, or a solicitor acting on a sale | Send only with the seller's agreement; see electrical certificates when selling a house |
| Another electrician doing the next EICR | Send with the client's agreement; it is what the model forms expect |
| The local authority or your scheme assessor | Councils normally ask the landlord; assessors see certificates under your scheme rules |
Send by a route that suits the content. A link that expires or a password-protected PDF is better than an open attachment for a report full of interior photos. For blocks and shared houses, where several people have an interest in one report, see EICRs for flats and communal areas and EICRs for HMOs.
What do you do with a deletion or access request?
The right to erasure in Article 17 is not absolute. It does not apply where you need the data to comply with a legal obligation or to establish, exercise or defend legal claims, and a certificate within its retention period is held for exactly that. So you can decline to delete the certificate and its schedules. Delete what has no continuing purpose, such as marketing details, and reply in writing within one month saying what you removed and why the rest is kept.
A subject access request is the mirror image: the person is entitled to a copy of the personal data you hold about them, free of charge, within one month. For a client that is usually the certificate, the invoice and your emails. For a tenant named on a landlord's report it is the data about them, which is not automatically the whole report, so check with the landlord before sending the full document.
What happens to certificates when you change software or stop trading?
Liability does not end when a subscription or a business does. Before cancelling any certificate software, export every certificate as a PDF with its schedules and check the count against your job list. A data export that only reloads into the same product is not an archive. What to check before you sign up is covered in electrical certification software: what to look for.
If you retire or close the company, keep the archive for the full retention period, stored encrypted with a backup, and tell your insurer so that run-off cover can be arranged. A sole trader remains personally liable for past work, and the certificate is still the first document a claim will ask for.
A retention policy you can copy
Five lines are enough for a privacy notice or an office procedure:
- Certificates, reports, schedules, supporting photos and instrument records: 15 years from completion, then securely deleted.
- Invoices, quotes that became jobs, CIS and VAT records: six years from the end of the financial year.
- Complaints and how they were resolved: six years from closure.
- Quotes that did not become jobs: two years.
- Marketing contact details: until the person opts out, reviewed every two years.
Set a reminder once a year to delete what has expired. For the paperwork side of the business, see invoicing and quoting basics and CIS and reverse charge VAT on invoices.
How Certio helps
Certio produces the EICR, EIC, Minor Works certificate and PAT records on the BS 7671 model forms and turns them into branded PDFs. Photograph the consumer unit and the circuit schedule drafts itself; point the phone camera at a Megger MFT-X1 and the reading goes straight into the schedule of test results, or dictate it while your hands stay on the probes. Suggested observation wording with the regulation reference is there for you to check and confirm. The judgement stays yours; the typing goes. Starter is free for 7 days, then £4.99 a month.