How Long Must You Keep Health and Safety Records? UK Guide

How long you must keep health and safety records depends on the type of record. Some, such as RIDDOR records, have a set minimum period in law, while others, such as health surveillance records for certain exposures, must be kept for decades. Getting retention right matters, because records are your evidence of compliance and may be needed long after an event. This guide sets out the main retention periods UK employers should follow.

Why retention periods matter

Health and safety records serve two purposes: they help you manage risk day to day, and they provide evidence that you met your legal duties. That evidence can be needed years later, for example if a former employee develops a work related illness and brings a claim, or if the HSE investigates a historic exposure. Keeping records for the right length of time protects both your workers and your business. Disposing of them too early can leave you unable to defend a claim or demonstrate compliance.

Common retention periods

While you should always check the specific requirement for each record type, the following are widely used retention periods for UK health and safety records:

• RIDDOR records: at least 3 years from the date of the reportable incident.

• Accident book entries: commonly kept for at least 3 years, and longer where they may relate to a future claim.

• Risk assessments: keep the current version, and retain superseded versions while they remain relevant; there is no single fixed period, but keeping a history is good practice.

• Training records: keep for the duration of employment and for a period afterwards, as evidence of competence.

• COSHH health surveillance records: must be kept for at least 40 years, because work related ill health can take decades to appear.

• Asbestos medical and exposure records: kept for at least 40 years due to the long latency of asbestos related disease.

• Noise and other exposure health records: long retention, often decades, where conditions can develop years later.

Why some records are kept for 40 years

Certain records, particularly health surveillance and exposure records for hazards such as hazardous substances, asbestos and noise, must be kept for at least 40 years. The reason is that the diseases linked to these exposures, such as occupational cancers, asbestos related conditions and noise induced hearing loss, often take decades to develop. A record created today may be the crucial evidence in a case that arises 30 years from now, so the law requires it to be retained for the long term.

Records relating to young people and special groups

Some records need particular care. Where an incident or exposure involves a young person, or where a condition might not manifest for many years, it is prudent to retain records for longer to allow for the extended period in which a claim could be brought. Personal data within these records must also be handled in line with data protection law, which requires you not to keep personal data for longer than necessary, so retention should be deliberate and justified rather than indefinite by default.

Storing records safely

Long retention only works if records are stored safely and can actually be found when needed. Paper records are vulnerable to loss, damage and disorganisation over many years, which is why many businesses move to secure digital storage. Whatever method you use, records should be backed up, protected against unauthorised access in line with data protection law, and organised so that a specific record can be retrieved quickly, even years later. Being unable to find a record you are legally required to hold is almost as problematic as not having kept it.

Balancing retention with data protection

Data protection law requires that personal data is not kept for longer than necessary, which sits alongside the duty to retain health and safety records. The way to reconcile these is to base your retention on the legitimate need to keep the record, the specific legal retention periods, and the period during which a claim could realistically arise. Documenting your retention approach in a simple retention schedule helps you keep what you must, dispose of what you should, and demonstrate that your decisions are considered rather than arbitrary.

Frequently asked questions

• How long must RIDDOR records be kept: At least 3 years from the date of the reportable incident.

• How long should health surveillance records be kept: COSHH and similar health surveillance records must be kept for at least 40 years because related illnesses can take decades to appear.

• How long should training records be kept: For the duration of employment and a period afterwards, as evidence of competence.

• Is there a single retention period for all health and safety records: No. Retention depends on the record type, ranging from 3 years for RIDDOR records to 40 years for certain health surveillance records.

• Can I keep health and safety records digitally: Yes, provided they are secure, backed up, retrievable and handled in line with data protection law.

Featherstone Safety Hub keeps your incidents, training records, assessments and evidence organised and retrievable for as long as you need them, with expiry tracking built in. Start your free 14 day trial of Featherstone Safety Hub.