Confidentiality and Record Keeping for Psychologists

8 min read Last updated June 2026

Confidentiality is the foundation of psychological practice — and its limits, and the records that support it, are unusually exacting. This guide explains what the Psychology Board’s Code of Conduct requires on privacy, consent and the limits of confidentiality, and sets out the record-keeping, security and retention rules to follow.

Key takeaways

The Code of conduct (section 3.3) treats privacy and confidentiality as fundamental and requires informed consent about information handling.
Explain the limits of confidentiality — risk, legal requirements, mandatory reporting — before the client discloses.
Consent is ongoing; revisit it as the work, the parties or the risk picture change.
Keep accurate, legible records including your risk assessment and the rationale for decisions.
Store securely and retain at least 7 years (adults) or until age 25 (children).

Confidentiality: the foundation of trust

Clients disclose deeply personal information on the understanding that it will be protected. The Psychology Board’s Code of conduct (section 3.3) treats privacy and confidentiality as fundamental, and requires informed consent about how information is handled — including the limits of confidentiality, how information is recorded, stored and used, and the nature and purpose of any disclosure. You must also comply with the Australian Privacy Principles.

Explaining the limits at the outset

Confidentiality is not absolute. At the start of the professional relationship — and again as circumstances change — explain when you may need to disclose information, for example where there is a serious risk to the client or others, where the law requires it, or in mandatory reporting. Clients should understand these limits before they disclose, not after.

Third parties, families and supervision

Working with couples, families or groups raises the question of who the client is and how information is managed between parties — agree this explicitly and record it. Sharing information in supervision or with other practitioners generally requires the client’s informed consent; if a client declines, consider whether the service can safely proceed.

Record keeping

Create and maintain accurate, legible records for every client interaction, including your assessment of risk and the rationale for decisions — not just outcomes.
Store records securely — physical records locked, digital records encrypted and access-controlled.
Retain records for at least 7 years after the last contact for adults, and for a child until they turn 25, then destroy securely.
Provide clients access to their records on request (generally within 30 days), subject to limited exceptions.
Note any multiple relationship, and document supervision or peer consultation.

Records, confidentiality and complaints

Breaches of confidentiality and poor record-keeping are among the more common sources of psychology notifications — and good records are also your best evidence of sound practice. See our guides to boundaries and dual relationships and Psychology Board complaints.

Related CPD courses

Build the confidentiality and documentation habits this article describes with CPD for Australian practitioners:

CPD courseConfidentiality in Healthcare Practice CPD courseDocumentation for Healthcare Professionals CPD coursePrivacy, Consent and Chaperone in Healthcare Practice

Continue the Psychology Board series

Complaints and Notifications Explained Professional Boundaries and Dual Relationships in Psychology

Frequently asked questions

What does the Code require on confidentiality?

It treats privacy and confidentiality as fundamental and requires informed consent about how information is recorded, stored, used and disclosed, including the limits of confidentiality, in line with the Australian Privacy Principles.

When can I disclose confidential information?

Generally only with consent, or where there is a serious risk to the client or others, where the law requires it, or under mandatory reporting — and clients should understand these limits before they disclose.

How long must psychologists keep records?

At least 7 years after the last contact for adults, and for a child until they turn 25, after which records should be securely destroyed.

Do clients have a right to their records?

Yes. Clients can generally access their records on request, usually within 30 days, subject to limited exceptions.

What should I record about decisions?

Your assessment of risk and the rationale for your decisions — not just the outcome — along with any multiple relationship and any supervision or peer consultation.

This article is general information for education and CPD purposes. It is not legal advice and does not create a practitioner–adviser relationship. If you have received a notification, seek advice from your professional indemnity insurer, your union or professional association, or an independent lawyer experienced in health practitioner regulation. Healthcare Ethics Courses is an independent education provider and is not affiliated with, endorsed by, or acting on behalf of Ahpra or any National Board; regulator names are used for reference only.