The UK GDPR and DPA do not impose a defined time limit for processing or storing data. However, data should not be stored for longer than necessary. Usually, data should be deleted once a the consultant’s engagement has ended. In some cases retaining data for a longer period of time may be justified, for instance on the grounds of a legitimate interest.
How long you retain data for should be set out in a document, for instance, a Data retention policy.