A missed patrol can become a client dispute months later. A minor welfare concern can become an insurance, employment or legal matter years later. That is why the question, “how long retain patrol records?”, needs more than a blanket answer such as “keep everything for six years”.

For UK security operations, there is no single retention period that applies to every patrol scan, incident report, GPS location point and occurrence-book entry. The right period depends on why the record was collected, the risk it evidences, contractual commitments and whether it contains personal data. The operational goal is clear: retain enough reliable evidence to prove service delivery and support investigations, but not so much data that you create unnecessary GDPR exposure.

How long to retain patrol records: the practical answer

Start by separating routine proof-of-presence data from records connected to an incident, safety issue, complaint or legal claim. A completed checkpoint scan and a detailed report about a forced entry should not automatically follow the same retention clock.

For many security providers and in-house teams in England and Wales, six years is a practical benchmark for records that may be needed to defend or pursue a contractual claim. This aligns with the usual limitation period for simple contract claims. It is often relevant where patrol evidence supports an SLA, a client invoice, a missed-service allegation or a negligence dispute.

That does not mean every piece of live location data should be held for six years. Under UK GDPR, personal data must be kept no longer than necessary for the purpose for which it was collected. Guard routes, timestamped check-ins and GPS positions can identify an individual’s movements and working patterns. If the operational need is to confirm that a patrol was completed and resolve short-term exceptions, a shorter period may be justified.

A sensible retention schedule will usually apply different periods to different classes of record, with a documented reason for each. In Scotland, limitation rules differ, so security businesses operating across the UK should take specific legal advice before relying on a single six-year rule.

Build retention periods around risk and purpose

Routine patrol verification records are primarily evidence that guards attended checkpoints, completed required tasks and followed scheduled routes. They support client reporting, supervisor checks, service-quality reviews and billing queries. Many organisations retain these records for a defined contractual period, often up to six years where the client agreement and claims risk justify it.

However, the volume matters. A system collecting GPS points every few minutes may generate far more personal data than is needed to prove a patrol. Consider retaining the verified patrol event, exceptions and route completion record for longer, while applying a shorter period to granular background location data. This approach preserves proof of performance without keeping an unnecessary movement history.

Incident reports require a more cautious approach. Records involving injury, aggression, trespass, theft, property damage, safeguarding, use of force, alarms or police attendance can remain relevant long after the shift ends. The retention period should reflect the nature of the event, the client’s sector, insurer requirements, foreseeable claims and any ongoing investigation.

Health and safety records may be subject to specific rules. For example, RIDDOR records must generally be kept for at least three years. Accident-book records are also commonly retained for at least three years, although an organisation may need to retain associated evidence longer where a claim remains possible. Records connected to exposure monitoring or health surveillance can carry substantially longer legal retention requirements. Do not apply a patrol-record deletion rule to those documents without checking the separate obligation.

A workable patrol record retention schedule

Rather than relying on memory, set out a written schedule approved by operational management, HR, data protection and, where appropriate, legal advisers. It should identify the record, its purpose, the lawful basis for processing, the retention period, the deletion method and the person responsible for review.

For a typical guarding operation, the schedule may distinguish between these categories:

• Routine patrol check-ins, task completions and checkpoint exceptions, retained according to the client contract and service-dispute risk.
• Detailed occurrence-book and incident reports, retained for a longer period where they may support an investigation, claim, disciplinary process or insurer notification.
• Live and historical GPS data, kept only for the period needed for operational control, welfare monitoring, route verification and defined dispute handling.
• Lone-worker alerts, panic alarms and man-down events, retained long enough to investigate the event, identify learning actions and meet health and safety requirements.
• CCTV clips, photographs, witness statements and police correspondence, controlled under their own evidence and data-protection rules rather than a generic patrol-data setting.

The precise numbers should be defensible, not arbitrary. A warehouse security contract with frequent stock-loss claims may justify longer retention of patrol exceptions than a low-risk office reception contract. Equally, a short-term construction site may need strong evidence during the project and defects period, while routine data can then be securely removed.

UK GDPR: keep evidence, reduce exposure

UK GDPR does not require an organisation to delete data immediately after a patrol ends. It requires storage limitation: personal data must not be kept indefinitely just because it might be useful later. Your privacy information should explain that patrol, location and incident data is processed for security operations, workforce management, safety, reporting and legal obligations where applicable.

Retention also needs to be technically enforceable. A policy that says location data is deleted after 90 days is of little value if exports, email attachments, spreadsheets and mobile devices retain copies for years. Managers should know where patrol evidence exists: the guard tour platform, reporting folders, client portals, email, HR files and investigation packs.

Access controls matter too. Supervisors may need current patrol visibility, but that does not mean every manager needs access to historic guard-location records. Restrict access by role, maintain audit logs and ensure leavers’ accounts are removed promptly. These controls reduce the risk of data being used for purposes that were never communicated to guards or clients.

A cloud-based system such as QR-Patrol helps by placing patrol events, incidents, forms and reports in one controlled environment rather than across paper occurrence books and disconnected files. The benefit is not simply convenience. Centralised records make it easier to apply consistent access permissions, retrieve evidence quickly and follow a documented retention process.

Put legal holds ahead of automatic deletion

Automatic deletion is good practice only when no reason exists to retain the record. If an incident is being investigated, a complaint has been made, a client has challenged performance, an employee grievance is underway or a claim is reasonably anticipated, suspend normal deletion for the relevant material.

This is often called a legal hold, although the process does not need to be complex. Identify the records, preserve them in their original form where possible, limit access and record why deletion has been paused. Once the matter is closed and the applicable retention period has passed, return the data to the normal disposal process.

For evidential value, retain the context as well as the scan. A single timestamp may show that a QR code was scanned. The associated patrol route, task instruction, exception note, corrective action, supervisor acknowledgement and audit trail can show what actually happened. This is particularly valuable where a client questions whether a guard merely scanned a checkpoint or completed the required security check.

Review the policy with clients and frontline teams

Retention periods should be agreed before a problem occurs. Review client contracts for audit rights, reporting requirements, minimum retention clauses and ownership of data at contract end. If a client requires records for seven years, establish whether that requirement is proportionate, who is the controller for each dataset and how data will be transferred or deleted when the contract ends.

Bring supervisors and guards into the process as well. They need clear instructions on what belongs in an incident report, when photographs should be taken, how to record a welfare concern and why personal notes or WhatsApp messages are not an acceptable substitute for the approved system. Good retention starts with complete, accurate records.

The strongest approach is not to keep every patrol record forever. It is to define what each record proves, retain it for a justifiable period and ensure it can be found when your organisation needs to demonstrate exactly what happened on site.