Your firm decides what client information is stored in ImmiPractice and for how long. Leads are deactivated rather than erased, payments cannot be deleted once an invoice has been issued, and a Business Admin can ask ImmiPractice to export or delete the business’s data by email. Deleted data remains only in encrypted backups until they expire after 30 days. Set your own retention schedule according to your regulator and the law.
- Your firm decides how long client data is kept in ImmiPractice.
- Leads are deactivated rather than erased; invoiced payments cannot be deleted.
- A Business Admin can request export or deletion of the business’s data by email.
- Deleted data remains only in encrypted backups until they expire after 30 days.
Retention is where privacy law and professional rules pull in different directions. Privacy law says keep personal information only as long as you need it. Your regulator, your insurer and the tax authorities may say keep the file for years after it closes. The CRM should not make that decision for you — and ImmiPractice does not.
Who decides how long client data is kept?
Your firm. As the organization accountable for the information, you set the retention period for each kind of record. ImmiPractice keeps what your account holds until your firm removes it or asks us to delete it.
How does ImmiPractice handle retention in the product?
| Record | What happens | Why |
|---|---|---|
| Leads | Deactivated rather than erased, and can be reactivated | So history is not lost by accident |
| Payments | Cannot be deleted once an invoice has been issued; invoices are locked once issued | Protects the integrity of financial records |
| Agreements | Every event — sent, viewed, reminded, signed, expired, superseded — is recorded on the audit trail | Evidence of what the client agreed to and when |
| Your firm’s data as a whole | A Business Admin can ask us to export or delete it by email | Lets you leave, or close out data you no longer need |
| Backups | Daily, encrypted, stored in Canada, kept 30 days | Disaster recovery; deleted data ages out of backups |
How should an immigration firm set its own retention schedule?
- List your record types. Leads that never became clients, active case files, closed case files, signed agreements, invoices and payment proofs, identity documents, communications.
- Find the rule for each one. Check your regulator’s file-keeping requirements (the CICC for RCICs, your law society for lawyers), tax rules for financial records, and any insurer or contractual requirements. Where no rule applies, privacy law expects you to keep information only as long as needed for the purpose you collected it for.
- Choose a trigger. Retention usually runs from an event — the file closing, the last invoice, a lead going cold — not from the date the record was created.
- Keep what you used to make a decision. If information was used to make a decision about someone, keep it long enough for that person to request access to it.
- Write it down. A one-page schedule that names the record, the period, the trigger and who reviews it is enough for most small practices.
- Review on a calendar. Pick a recurring date — quarterly or yearly — to deactivate stale leads, export closed files you must archive, and request deletion of what you no longer need. A recurring task in ImmiPractice’s tasks and reminders keeps the review from slipping.
How long should client records be kept in an immigration CRM?
At least as long as your regulator requires, and no longer than you need:
- RCICs: the CICC requires client files to be kept for a minimum of six years after the file is closed, in a secure and accessible location, with a list of closed files and a projected destruction date (CICC Client File Management Regulation, s. 7).
- Lawyers: follow your law society’s file-retention guidance, for example the Law Society of Ontario’s guide to retaining client files.
- PIPEDA: keep personal information only as long as it is needed for the purpose it was collected for, and set both minimum and maximum retention periods (Principle 5).
In practice: keep the whole closed file in the CRM for at least six years (RCICs) or your law society’s period, record the planned destruction date when you close it, and delete or anonymize it when that date arrives unless a complaint, claim or new matter requires you to keep it.
Example: a closed visitor-visa file
Maya’s visitor visa was approved and her file is closed. Her signed retainer agreement and invoices stay in ImmiPractice for the period your regulator and tax rules require. Her uploaded bank statements may not need to be kept that long in the live system; your schedule might say to download the final document bundle as a ZIP for your archive and then remove what you no longer need. When the retention period ends, your Business Admin requests deletion of what remains that the product does not let you remove yourself.
What about leads that never became clients?
Unconverted leads are easy to forget and often the largest pile of personal information a firm holds. Decide how long a lead stays useful — for follow-up and marketing to people who opted in — and deactivate it after that. If someone asks you to stop contacting them, honour the request right away: email campaigns include unsubscribe handling, and WhatsApp broadcasts go only to contacts marked as opted in.
Related reading
See how to delete client data, backups and disaster recovery, and file-keeping obligations for consultants and lawyers.
This is general information, not legal advice.
General information about running an immigration practice — not legal advice. Rules change; confirm current requirements with official sources and your regulator.