What records must an online pharmacy keep, and for how long?

Which rules set the retention periods?

Four sets of rules decide how long a pharmacy keeps each record. The Human Medicines Regulations 2012 (SI 2012/1916) cover private prescriptions, the prescription-only medicines register and unlicensed specials. The Misuse of Drugs Regulations 2001 (SI 2001/3998), as amended, cover controlled drug registers and requisitions. The Medicines (Pharmacies) (Responsible Pharmacist) Regulations 2008 cover the responsible pharmacist record. UK GDPR sets no fixed period for clinical records, so the NHS Records Management Code of Practice fills the gap.

The GPhC does not publish a retention table of its own. Its standards for registered pharmacies require that "all necessary records for the safe provision of pharmacy services are kept and maintained" (standard 1.6). Its February 2025 guidance for pharmacies providing services at a distance lists the extra records an online pharmacy must hold. It then says that "all applicable laws covering how long records need to be kept must be followed". The regulator expects you to know the statutory periods and to apply them in a written schedule.

The table summarises the periods set out in those documents. The sections below give the detail and the regulation numbers.

How long must you keep private prescriptions and the POM register?

Two years. Regulation 253 of the Human Medicines Regulations 2012 applies to anyone running a retail pharmacy business. It requires an entry "in a written or computerised record" for every sale or supply of a prescription-only medicine. The entry must be made on the day of supply, or the next day if that is not practicable. The regulation then requires the record and the prescription itself to be preserved for "two years beginning immediately after the relevant date".

The relevant date differs for the two documents. For the register, it is the date of the last entry in that record. For the prescription, it is the date of the supply, or the date of the final supply where the prescription was repeatable. A register that stays open for years therefore runs its two-year clock from the day you close it.

Schedule 23 sets the particulars. Each entry records the date of supply, the medicine's name, quantity, form and strength, the prescriber's name and address, the patient's name and address, and the date on the prescription. Emergency supplies at a patient's request also record the name and address of the person who needed the medicine and the nature of the emergency. Emergency supplies at a prescriber's request record the date the written prescription later arrived.

Four supplies are exempt from the register. NHS prescriptions go to the NHSBSA for payment. Oral contraceptives on prescription are excluded. Supplies of Schedule 1 and 2 controlled drugs are recorded in the CD register instead. Wholesale supplies are exempt where you keep the order or invoice. For an online pharmacy dispensing private prescriptions from its own prescribers or a partner clinic, almost every supply belongs in the register.

How long is the controlled drug register kept?

Two years from the date of the last entry, under regulation 23 of the Misuse of Drugs Regulations 2001. Regulation 23 also preserves requisitions for two years, and regulation 24 keeps invoices for Schedule 3 and 5 drugs for two years from issue. Private prescriptions for Schedule 2 and 3 controlled drugs are not retained in the pharmacy. Since the 2006 amendment they are sent to the NHSBSA for monitoring.

Regulation 19 sets the content. For every Schedule 1 or 2 drug obtained, the register records the date received, the supplier's name and address and the quantity. For every supply it records the date, the name and address of the person or firm supplied, the prescriber or licence details that gave authority to possess, and the quantity. For Schedule 2 drugs it also records who collected the medicine, whether proof of identity was requested and whether it was provided.

Regulation 20 sets the form. Each strength and form of a drug has its own page. Entries are made on the day of the transaction or the next day. No entry may be cancelled, obliterated or altered: a correction is made only by a dated marginal note or footnote. Entries are in ink or otherwise indelible, or in a computerised form that follows best practice guidance endorsed by the Secretary of State. Each set of premises has its own register, and it stays at those premises.

That computerised option arrived with SI 2005/2864, in force from 14 November 2005. It requires every electronic entry to be "attributable and capable of being audited". Most PMR-integrated registers now meet that test, and the practical detail is covered in our guide to running an electronic CD register. SPS also notes the government's stated intention to require secure copies of a CD register for up to 11 years once electronic registers are in widespread use. That is not yet law.

Which records must you keep for five years or more?

Two pharmacy records have a five-year minimum, and company records run to six. Regulation 170 of the Human Medicines Regulations 2012 requires anyone supplying an unlicensed special or import to keep a record for "at least five years". It must show the source and date you obtained the product, the person you supplied and the date, the quantity, the batch number and details of any suspected adverse reaction. You must produce it to the MHRA on request. SPS adds that, for specials prepared on the premises, product liability rules argue for 25 years where the patient is a child.

The responsible pharmacist record is the second. Regulation 5 of the Medicines (Pharmacies) (Responsible Pharmacist) Regulations 2008 sets its content. The record shows the pharmacist's name and registration number, and the date and time they became responsible pharmacist. It shows the date and time they ceased, and the date, start and return time of any absence. The record may be written, electronic or both. It must be preserved for not less than five years, counted from the day an electronic record is created or from the last day a written record covers.

Company accounting records sit outside pharmacy law but belong in the same schedule. GOV.UK states that a limited company must keep its records "for 6 years from the end of the last company financial year they relate to", and longer in some circumstances. Invoices for medicines, including controlled drugs, fall under that rule.

How long should consultation and clinical records be kept?

Eight years after the last treatment for an adult, under the NHS Records Management Code of Practice. The Code was published in August 2021 and has been updated since, most recently in May 2024. It is the retention authority for NHS-funded care in England. Its schedule gives the figures below.

The Code binds "organisations working within, or under contract to, the NHS in England". A pharmacy with an NHS contract is covered, and Community Pharmacy England restates the eight-year figure for clinical records from advanced services. Reimbursement records for Pharmacy First, the New Medicine Service, hypertension case-finding and flu vaccination are kept for three years. A purely private online pharmacy is, in the Code's own words, "not strictly covered", but "can also use this Code for guidance". There is no better benchmark, and an inspector or a court will ask why you departed from it.

Two further figures matter. SPS advises keeping the patient medication record for ten years after the patient's death, citing the Code. And UK GDPR sets no period at all. Article 5(1)(e) requires personal data to be kept "for no longer than is necessary" for its purpose. The ICO's guidance says the UK GDPR "does not set specific time limits for different types of data". It asks you to document standard retention periods for each category. And it requires you to erase or anonymise data once the period ends. A pharmacy that keeps consultation records for eight years because the Code says so has a justification. One that keeps them indefinitely does not.

Do online pharmacies have extra record-keeping duties?

Yes. The GPhC's February 2025 guidance for registered pharmacies providing pharmacy services at a distance adds a list of records that a bricks-and-mortar pharmacy rarely needs. Section 1.4 says necessary records, "whether on paper or electronic", must be kept and maintained. Paragraph 1.4(g) then names them.

You must record which staff are accountable and responsible for each part of the service. You must record the information and advice given to people on using their medicines safely. You must keep clinical records showing "the key points on which the decision is made to make or refuse a sale or supply". You must hold information about the safeguards put in place by any online prescribing service you work with. You must record the person's consent to the delivery method, the method used, the date of dispatch and "the record of successful delivery". You must log complaints and the steps taken to put things right. And you must keep IT records.

Two further duties generate records of their own. For weight-management medicines, paragraph 4.2(l) requires the prescriber to independently verify the person's weight, height or BMI, and states that a phone call is not an appropriate way to do it. The evidence used for that check, and the refusals that follow when it fails, belong in the clinical record. Our guide to the verification duties for weight-loss supply sets out what inspectors expect to see. Identity checks on patients and registration checks on prescribers should be recorded in the same way.

Can records be kept electronically?

Yes, for almost every record on the list. Regulation 253 allows the POM register to be "written or computerised". Regulation 20 of the Misuse of Drugs Regulations 2001 allows a computerised CD register. Each entry must be attributable and auditable, follow the endorsed best practice guidance and remain accessible from the premises it relates to. Regulation 5 of the Responsible Pharmacist Regulations allows an electronic RP record. The GPhC's distance-selling guidance accepts records "on paper or electronic".

Paper private prescriptions are the exception. Regulation 253 requires the prescription itself to be preserved, so keep the original and treat any scan as a working copy. Electronic private prescriptions are different. Regulation 219 of the Human Medicines Regulations 2012 allows a prescription created electronically, signed with an advanced electronic signature and sent to the pharmacy as an electronic communication. Keep that electronic prescription, with its signature data, for the same two years. Prescriptions for Schedule 2 and 3 controlled drugs can only go electronic through the NHS Electronic Prescription Service.

Electronic storage changes the risks rather than removing them. A register that cannot be produced at the counter fails the accessibility test. A consultation note with no timestamp or author is hard to defend. And a record locked inside a system you have left is a record you no longer hold. Before switching PMR, check what you can export and in what format. Our guide to recording patient notes on a PMR covers the structure that makes a note stand up years later.

How do you build a retention schedule an inspector will accept?

Write one document that lists each record type, its period, the rule that sets it and what happens at the end. That is what the ICO means by documenting standard retention periods, and it is the evidence for GPhC standard 1.6. Pharmacies with an NHS contract already commit to records management through the Data Security and Protection Toolkit, so the schedule also answers that declaration.

Do not delete early to look tidy. A record destroyed before its statutory period has expired is a breach of the regulation that set the period. A record kept long after its purpose has ended is a breach of UK GDPR. The schedule is how you show you have done neither.

Key takeaways

FAQs