Proper record keeping is fundamental to managing health and safety effectively. Records demonstrate compliance, help identify trends, provide evidence of due diligence, and are essential if accidents occur or inspectors visit. But what records must you keep, for how long, and in what format?
Do you keep organized health and safety records?
Let's assess your current situation.
Why health and safety record keeping matters
Record keeping is not optional bureaucracy. It serves critical purposes:
Legal compliance: Many health and safety regulations explicitly require you to keep records. Failure to do so is a breach of the law and can result in enforcement action.
Evidence of due diligence: If an accident occurs or you face prosecution, your records demonstrate that you took your responsibilities seriously. They can be the difference between successful defence and significant penalties.
Trend identification: Records help you spot patterns — recurring accidents, training gaps, or emerging risks — allowing you to take preventive action.
Management information: Good records inform decisions about resource allocation, training needs, and safety improvements.
Insurance and claims: Insurers require records to process claims and set premiums. Complete records support your position in civil litigation.
Inspection readiness: HSE or local authority inspectors will ask to see various records. Having them organized and accessible demonstrates competence and professionalism.
The absence of records is often interpreted as evidence that required activities haven't been done. If you trained someone but can't prove it, the inspector will assume you didn't. Document everything that matters.
Legal requirements for record keeping
The obligation to keep health and safety records comes from multiple regulations:
Management of Health and Safety at Work Regulations 1999:
- Record findings of risk assessments (if 5+ employees)
- Record arrangements for health and safety management
- Record health surveillance
- Record information provided to employees
RIDDOR 2013 (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations):
- Keep records of reportable accidents, diseases, and dangerous occurrences for 3 years
- Maintain an accident book for all workplace accidents
Control of Substances Hazardous to Health Regulations 2002 (COSHH):
- Record COSHH assessments
- Keep health surveillance records for 40 years
- Maintain exposure monitoring records for 5 years
Electricity at Work Regulations 1989:
- Keep records of electrical inspections and testing
Health and Safety at Work etc. Act 1974:
- Record your health and safety policy (if 5+ employees)
- Maintain employers' liability insurance certificate (displayed and archived for 40 years)
Different records have different retention periods. Some must be kept for 3 years, others for 40 years or longer. Using the wrong retention period can leave you without vital evidence when you need it most.
Essential health and safety records you must keep
1. Risk assessments
What to keep:
- Written risk assessments for all significant workplace hazards
- Action plans showing how risks will be managed
- Records of when assessments were reviewed
- Evidence of consultation with employees
Who must keep them:
- All employers must conduct risk assessments
- Employers with 5+ employees must record significant findings in writing
- Smaller employers should keep written records even though not legally required
Retention period:
- Keep current assessments readily accessible
- Archive superseded assessments for at least 3 years
- For high-risk activities or hazardous substances, consider keeping indefinitely
Why it matters: Risk assessments are the foundation of health and safety management. If you can't produce them during an inspection, it suggests you haven't fulfilled your fundamental duty under the Management Regulations.
Don't just keep the final assessment. Record when you reviewed it, who was consulted, and what changes you made. This demonstrates active management, not just box-ticking.
2. Accident and incident records
What to keep:
- Accident book entries (all workplace accidents and injuries)
- First aid treatment records
- Near-miss reports
- Investigation reports for serious incidents
- RIDDOR reports (reportable accidents, diseases, dangerous occurrences)
Legal requirements:
- Accident book: All accidents must be recorded, however minor
- RIDDOR records: Must be kept for 3 years from the date of the incident
- Data protection: Accident book entries contain personal data and must be kept securely
Retention period:
- Minimum: 3 years from date of incident (legal requirement for RIDDOR)
- Recommended: 6+ years (civil claims can be brought up to 6 years after an incident, or longer for latent injuries)
- Best practice: Keep indefinitely if injuries involve potential long-term health effects or exposure to hazardous substances
Why it matters: Accident records are critical evidence if claims are made years after an incident. They also help identify trends and recurring issues that need addressing.
Employer couldn't defend claim due to missing records
An ex-employee brought a civil claim 5 years after leaving, alleging repetitive strain injury from poor workstation setup. The employer had no records of workstation assessments, training provided, or complaints raised during employment.
- ✗No Display Screen Equipment (DSE) assessment records kept
- ✗No record of ergonomic training provided to employee
- ✗No evidence of adjustments made to workstation
- ✗Accident book entries discarded after 3 years
- ✗No contemporaneous notes from any discussions about discomfort
- ✗Company couldn't prove they had met their duties
Without records to demonstrate they'd taken reasonable steps, the employer couldn't defend the claim. They settled for £35,000 plus legal costs. Had they kept proper records showing they'd conducted DSE assessments and provided training, they would have had a strong defence.
Three years is the minimum for RIDDOR records, but many workplace health issues manifest years later. Keep records longer than the legal minimum, especially for anything involving potential chronic health effects.
3. Training records
What to keep:
- Induction training records for new starters
- Job-specific health and safety training
- Fire warden/marshal training
- First aid training
- Manual handling training
- Display screen equipment training
- COSHH training
- Training on specific equipment or procedures
- Refresher training records
- Certificates from external training providers
Details to record:
- Name of employee
- Date of training
- Type/topic of training
- Duration
- Name of trainer
- Competence of trainer
- Confirmation that employee understood the training
- Date refresher training is due
Retention period:
- Keep current training records for all employees
- Retain for at least 6 years after employee leaves
- For work involving hazardous substances or serious risks, consider keeping longer
Why it matters: Training records prove you've met your duty to provide "information, instruction, training and supervision" under Section 2 of HSWA 1974. Without records, you can't demonstrate compliance.
Use a training matrix to track what training each employee needs and when refreshers are due. This makes it easy to spot gaps and ensures no one misses required training.
4. Equipment inspections and maintenance
What to keep:
- Records of equipment inspections and testing
- Maintenance logs and service records
- Portable appliance testing (PAT) records
- Lifting equipment thorough examination certificates (LOLER)
- Pressure system examinations
- Local Exhaust Ventilation (LEV) testing
- Fire safety equipment testing and servicing
- Emergency lighting tests
- Fire alarm testing
Legal requirements vary by equipment type:
- Lifting equipment: Thorough examination every 6-12 months (LOLER 1998)
- Electrical equipment: Regular inspection based on risk (Electricity at Work Regulations 1989)
- Pressure systems: Written scheme of examination (Pressure Systems Safety Regulations 2000)
- LEV systems: Thorough examination every 14 months (COSHH Regulations 2002)
Retention period:
- Minimum: Until the next inspection/test (to show equipment is current)
- Recommended: 3-5 years to demonstrate history of maintenance
- LOLER records: Must keep until next report, but good practice to retain longer
Why it matters: If equipment fails and causes injury, inspectors will ask to see maintenance records. Gaps in inspection or maintenance records suggest negligence.
5. Health surveillance records
What to keep: Health surveillance records for employees exposed to specific health risks:
- Noise-induced hearing loss (regular noise exposure above 85dB)
- Vibration exposure (hand-arm vibration syndrome)
- Respiratory conditions (asbestos, dust, fumes)
- Skin diseases (irritants, sensitizers)
- Occupational asthma
- Other exposure to hazardous substances
Details to record:
- Employee's name and date of birth
- Type and date of surveillance
- Name of person conducting surveillance
- Results and any action taken
- Date next surveillance is due
Retention period:
- COSHH surveillance: 40 years from the date of last entry
- Noise exposure: 40 years
- Asbestos exposure: 40 years
Why it matters: Many occupational diseases don't manifest for decades. Long retention periods ensure records are available if former employees develop work-related illnesses years after exposure.
Health surveillance records are confidential medical data. They must be kept securely with restricted access and in compliance with UK GDPR. Never include medical details in general personnel files.
6. Safety inspections and audits
What to keep:
- Workplace inspection reports
- Safety audit findings
- Action plans from inspections
- Evidence of actions completed
- External consultant reports
- Enforcement notices from HSE or local authorities
Typical inspection types:
- General workplace inspections (weekly/monthly)
- Department or area-specific inspections
- Fire safety checks
- First aid provision checks
- Annual health and safety audits
- External consultant assessments
Retention period:
- Keep current inspection reports and action plans
- Archive completed inspections for at least 3 years
- Keep enforcement notices indefinitely
Why it matters: Regular inspection records demonstrate active safety management. They show you're identifying and addressing hazards proactively, not just reacting to incidents.
7. Consultation and communication records
What to keep:
- Health and safety committee meeting minutes
- Employee consultation records
- Safety suggestions and responses
- Safety bulletins and communications
- Evidence of policy distribution to employees
- Sign-off sheets for important safety communications
Legal requirement: You must consult employees (or their representatives) on health and safety matters. Keep records proving:
- You consulted on changes affecting their health and safety
- You informed them of risks and control measures
- You provided them with health and safety information
Retention period:
- Keep meeting minutes for at least 3 years
- Retain consultation records for significant changes for 6+ years
Why it matters: Consultation is a legal requirement. Records prove you didn't just impose changes but involved employees in health and safety decisions.
8. Contractor management records
What to keep:
- Pre-qualification information (competence, insurance, safety record)
- Method statements and risk assessments from contractors
- Permit to work records
- Induction records for contractors
- Incident reports involving contractors
- Evidence of coordination and cooperation
Retention period:
- Keep during the contract period
- Retain for 6 years after contract completion
- Keep longer if work involved high-risk activities
Why it matters: You have duties under Section 3 of HSWA 1974 to non-employees, including contractors. If a contractor is injured on your premises, you must demonstrate you took reasonable steps to ensure their safety.
9. Employers' Liability Insurance certificate
What to keep:
- Current employers' liability insurance certificate (must be displayed or readily available)
- All expired certificates
Legal requirement:
- Must display current certificate prominently in the workplace
- Must retain certificates for 40 years
- Must have minimum £5 million coverage (most policies provide £10 million)
Retention period:
- 40 years — This long period accounts for diseases and injuries that may not manifest for decades
Why it matters: Employers' liability insurance covers claims from employees for work-related injuries and illnesses. Claims can be made many years after exposure or injury, so you must prove you had valid insurance at the time.
Many employers display the current certificate but discard old ones. This is a serious mistake. Store expired certificates securely for 40 years. Without them, you may face uninsured claims from former employees.
10. Specific hazard assessments and monitoring
Depending on your workplace, you may need additional specialized records:
COSHH assessments:
- Assessment of substances hazardous to health
- Monitoring of exposure levels
- Retention: Assessments for at least 5 years; exposure monitoring for 5 years; health surveillance for 40 years
Noise assessments:
- Noise risk assessments
- Hearing protection zones
- Health surveillance (audiometry)
- Retention: 40 years
Manual handling assessments:
- Assessment of manual handling tasks
- Evidence of training provided
- Retention: 3-6 years minimum
Fire risk assessments:
- Fire risk assessment and action plan
- Fire drill records
- Fire alarm and emergency lighting tests
- Retention: Current assessment readily available; superseded assessments for 3+ years
Asbestos management:
- Asbestos survey reports
- Asbestos management plan
- Records of work with asbestos
- Retention: Indefinitely (asbestos-related diseases can take 20-50 years to develop)
Legionella risk assessment:
- Water risk assessment
- Temperature monitoring records
- Cleaning and maintenance logs
- Retention: Current records plus 5 years
Summary of retention periods
Record Retention Requirements
3-6 Years
- •RIDDOR records: 3 years minimum
- •General accident records: 6 years recommended
- •Risk assessments: 3+ years (archived)
- •Training records after employee leaves: 6 years
- •Workplace inspection reports: 3-6 years
- •Fire drill records: 3 years
- •COSHH assessments: 5 years
40 Years or More
Recommended- •Employers' liability insurance certificates: 40 years
- •Health surveillance (COSHH, noise, vibration): 40 years
- •Asbestos exposure records: Indefinitely
- •Records of work with ionizing radiation: Indefinitely
- •Records involving potential long-term health effects: 40+ years
- •Any exposure to carcinogens or mutagens: Indefinitely
Bottom line: Retention periods vary dramatically. Short periods apply to routine safety management records. Long periods are required for anything that could cause latent disease or long-term health effects. When in doubt, keep records longer.
| Record Type | Minimum Retention | Recommended | Reason |
|---|---|---|---|
| RIDDOR reports | 3 years | 6+ years | Legal minimum vs civil claims limitation |
| Accident book | 3 years | 6+ years | Civil claims can be brought up to 6 years later |
| Risk assessments | Until superseded | 3+ years after superseded | Demonstrate ongoing management |
| Training records (current staff) | Duration of employment | Plus 6 years after leaving | Prove training was provided |
| Training records (ex-staff) | N/A | 6 years after leaving | Defence against future claims |
| COSHH assessments | 5 years | 40 years if health surveillance | Many chemical exposures have latent effects |
| Health surveillance | 40 years | Indefinitely for serious hazards | Occupational diseases can take decades to appear |
| Employers' liability insurance | 40 years | 40 years | Legal requirement |
| Equipment inspection (LOLER) | Until next inspection | 3-5 years | Show history of maintenance |
| Fire alarm tests | Current records | 2-3 years | Demonstrate compliance with testing regime |
| Asbestos records | Indefinitely | Indefinitely | Asbestos diseases appear 20-50 years post-exposure |
| Noise exposure records | 40 years | 40 years | Hearing damage is cumulative and latent |
| Manual handling assessments | 3 years | 6 years | Musculoskeletal injuries may develop over time |
The longer retention periods reflect the reality that many occupational diseases and injuries don't manifest immediately. Keep records much longer than you think you need to. Storage is cheap; uninsured claims are not.
Digital vs paper records
Both digital and paper records are acceptable, provided they are:
- Secure and protected from loss, damage, or unauthorized access
- Retrievable when needed
- Accurate and complete
- Compliant with data protection requirements
Advantages of digital records
Accessibility:
- Easy to retrieve from multiple locations
- Searchable and filterable
- Can be accessed remotely
Security:
- Backups protect against loss
- Access controls prevent unauthorized viewing
- Audit trails show who accessed records
Efficiency:
- Reduce physical storage space
- Easy to share with inspectors or insurers
- Automated reminders for reviews and renewals
Analysis:
- Extract data for trend analysis
- Generate reports and dashboards
- Identify patterns across multiple records
Advantages of paper records
Simplicity:
- No technical skills required
- No dependency on IT systems
- Immediate access without passwords or systems
Reliability:
- Can't be deleted accidentally
- Not vulnerable to cyber attacks
- Don't require software to access
Signatures:
- Original signatures carry legal weight
- No questions about authenticity
Best practice: Hybrid approach
Many organisations use a combination:
- Keep original signed documents in paper form (or scanned with secure storage)
- Maintain digital copies for day-to-day use
- Use digital systems for routine logging (inspections, training, incidents)
- Back up digital records regularly
- Ensure both systems are organized and accessible
Whichever system you choose, the critical requirements are the same: records must be complete, accurate, secure, retrievable, and kept for the required retention period. The format matters less than the quality and accessibility of the information.
Digital record keeping considerations
If using digital records:
Data protection compliance:
- Health and safety records often contain personal data
- Must comply with UK GDPR
- Have appropriate security measures
- Implement access controls
- Have data retention and disposal policies
Backup and disaster recovery:
- Regular automated backups
- Off-site or cloud backup storage
- Test restoration procedures
- Have a plan for system failures
Long-term accessibility:
- Ensure files can still be opened decades later
- Consider format obsolescence (can you open a WordPerfect file from 1995?)
- Use widely-adopted formats (PDF, Word, Excel) rather than proprietary ones
- Document your file structure and naming conventions
Version control:
- Track which version of documents is current
- Record when documents were revised
- Keep superseded versions accessible
Company lost vital records in ransomware attack
A manufacturing company suffered a ransomware attack that encrypted all their files. They had kept all health and safety records digitally but had no off-site backups. Years of training records, accident reports, risk assessments, and inspection records were lost.
- ✗All records kept digitally with no paper copies
- ✗No off-site or cloud backups
- ✗Local backups were also encrypted by ransomware
- ✗No disaster recovery plan tested
- ✗10 years of records lost
- ✗Could not demonstrate compliance during HSE inspection 6 months later
The company faced improvement notices requiring them to recreate risk assessments and conduct all training again. They couldn't defend claims from two former employees because accident records no longer existed. The business nearly failed due to the combination of ransomware costs, regulatory enforcement, and legal claims.
If you go digital, you must have robust backups. Use the 3-2-1 rule: 3 copies of your data, on 2 different media types, with 1 copy off-site. Test your backups regularly. Consider keeping paper or offline copies of critical long-term records.
Organizing your records: Practical tips
Good record keeping isn't just about retention periods. It's about being able to find what you need, when you need it.
Create a records index
Maintain a master list of what health and safety records you keep, where they're stored, and when they were last reviewed:
- Risk assessments
- Accident records
- Training matrix
- Equipment inspection logs
- Consultation records
- Policy documents
- Audit reports
Use consistent naming conventions
Whether digital or paper, use a logical, consistent system:
Poor: "RA draft v3 final FINAL.docx" Better: "2024-12-18_Fire-Risk-Assessment_Main-Building.pdf"
Include dates, document types, and clear descriptions in file names.
Implement a review schedule
Set reminders for:
- Annual review of risk assessments
- Equipment inspection due dates
- Training renewal dates
- Policy review dates
- Records due for archiving or disposal
Restrict access appropriately
Health and safety records often contain personal or sensitive information:
- Medical records should be accessible only to authorized personnel
- Accident records contain personal data — comply with GDPR
- Implement role-based access for digital systems
- Lock paper records in secure cabinets
Regular housekeeping
Schedule time to:
- File loose records promptly
- Archive old records according to retention schedule
- Dispose of records that have passed retention periods (securely)
- Check backups are working
- Ensure systems are still fit for purpose
Assign responsibility for record keeping to a specific person or role. If everyone is responsible, no one is responsible. Make it clear who maintains each type of record and who checks they're up to date.
What happens if you don't keep proper records?
Failure to keep adequate health and safety records creates multiple problems:
Regulatory enforcement
HSE or local authority inspectors will ask to see records during visits. If you can't produce them:
- Improvement notices requiring you to establish proper systems
- Prohibition notices if lack of records indicates serious risks aren't being managed
- Prosecution for breaches of specific regulations requiring records
- Fines and enforcement costs
Civil litigation
If an employee (or former employee) makes a claim for work-related injury or illness:
- Without records, you can't prove you took reasonable precautions
- You can't defend against allegations you didn't train, assess risks, or maintain equipment
- Settlement costs will be higher
- Legal costs will escalate
Insurance issues
Insurance companies may:
- Refuse to cover claims if you can't provide required records
- Increase premiums if your record keeping is poor
- Decline to renew policies
- Reduce claim payments
Reputational damage
Poor record keeping suggests poor health and safety management generally:
- Clients may not wish to contract with you
- Supply chain audits may exclude you
- Recruitment becomes harder if you're known for poor safety
Management problems
Without records, you can't:
- Identify trends in accidents and incidents
- Spot training gaps
- Demonstrate compliance to auditors
- Make informed decisions about safety improvements
- Monitor whether actions from risk assessments are completed
"We do the training/inspections/maintenance, we just don't write it down" is not a defence. Without records, you cannot prove you did what you claim. Inspectors and courts will assume you didn't.
Setting up a record keeping system
If you're starting from scratch or improving an existing system:
Step 1: Identify what records you need
Review your legal obligations based on:
- Your industry and activities
- Hazards present in your workplace
- Size of your workforce
- Specific regulations that apply to you
Use this article's checklist to identify mandatory records.
Step 2: Decide on storage method
Choose digital, paper, or hybrid approach based on:
- Your technical capability
- Number of records you need to keep
- Accessibility requirements
- Budget for systems and storage
Step 3: Create templates and forms
Develop standardized forms for:
- Accident reporting
- Training records
- Inspection checklists
- Risk assessment templates
- Equipment maintenance logs
Consistent formats make record keeping easier and ensure you capture all necessary information.
Step 4: Assign responsibilities
Make clear who is responsible for:
- Creating and updating each type of record
- Filing and storing records
- Reviewing and archiving records
- Ensuring retention periods are met
- Responding to requests for records
Step 5: Train relevant staff
Ensure people responsible for record keeping understand:
- What needs to be recorded
- How to complete forms accurately
- Where to store records
- Data protection requirements
- Retention periods
Step 6: Implement and monitor
- Start using your system
- Review periodically to ensure it's being followed
- Conduct audits to check completeness and accuracy
- Adjust the system based on experience
Step 7: Plan for long-term retention
For records requiring long retention periods (40 years):
- Consider how you'll ensure accessibility over decades
- Plan for changes in technology
- Establish secure archive storage
- Document where old records are kept
Common record keeping mistakes
1. Not keeping records at all
The mistake: "We do health and safety, we just don't write it down."
Why it's a problem: You can't prove you did anything. Legally and practically, if you didn't record it, it didn't happen.
The fix: Implement a systematic record keeping approach for all mandatory records.
2. Keeping records but can't find them
The mistake: Records exist but are scattered across multiple locations, filing systems, and people's desks or computers.
Why it's a problem: When an inspector asks for records or you need to defend a claim, you can't retrieve them. Inaccessible records are almost as bad as no records.
The fix: Create a central records index. Use consistent naming and filing. Make it clear where each type of record is kept.
3. Using wrong retention periods
The mistake: Discarding accident records after 3 years because that's the RIDDOR requirement, not realizing civil claims can be brought later.
Why it's a problem: You lack evidence to defend claims. You may face uninsured losses.
The fix: Understand different retention requirements for different records. When in doubt, keep longer.
4. No backups of digital records
The mistake: All records kept digitally on one computer or server with no backup.
Why it's a problem: Hardware failure, theft, fire, flood, or cyber attack can destroy years of records instantly.
The fix: Implement regular automated backups with off-site storage. Test restoration procedures.
5. Incomplete or inaccurate information
The mistake: Forms completed hastily with missing information, unclear details, or errors.
Why it's a problem: Incomplete records don't fulfil legal requirements and can't be used as evidence.
The fix: Use templates with clear fields. Train people on what needs to be recorded. Review records for completeness before filing.
6. Not treating records as confidential
The mistake: Leaving accident books or medical records accessible to all staff, or storing them insecurely.
Why it's a problem: Data protection breaches. Potential fines from ICO. Privacy violations.
The fix: Restrict access to personal and medical records. Store securely. Comply with UK GDPR.
7. No system for review or update
The mistake: Records created but never reviewed or updated. Outdated information remains on file.
Why it's a problem: Records don't reflect current situation. Gives false assurance.
The fix: Implement review schedules. Assign responsibility for keeping records current. Archive superseded records appropriately.
Using records to improve health and safety
Good record keeping isn't just about compliance. Records are a valuable tool for continuous improvement:
Accident trend analysis
Review accident records regularly to identify:
- Common injury types
- Recurring locations or activities
- Times of day when incidents peak
- Whether control measures are working
- Whether training is effective
Example: A warehouse noticed from their records that most accidents occurred in the first hour of shifts. Investigation revealed inadequate warm-up and rushed working due to shift handover pressure. Changes to shift patterns and a warm-up routine reduced accidents by 40%.
Training needs identification
Use training records to spot:
- Staff due for refresher training
- High turnover areas needing more frequent induction
- Gaps in competence affecting safety performance
- Whether training is translating to safer behaviour
Maintenance effectiveness
Equipment inspection records can reveal:
- Whether maintenance intervals are appropriate
- Recurring defects suggesting design or usage problems
- Whether equipment is nearing end of life
- Costs of maintenance vs replacement
Risk assessment validation
Compare risk assessments against accident records:
- Are the risks you identified actually causing harm?
- Are there accidents from hazards you didn't assess?
- Are your control measures working as intended?
Records are not just historical evidence. They're forward-looking tools. Analyze your records regularly to identify patterns and opportunities for improvement. Reactive record keeping is compliance. Proactive analysis is good management.
Frequently asked questions
Both electronic and paper records are acceptable under UK health and safety law, as long as they are secure, accurate, complete, and retrievable when needed. Electronic records offer advantages like easier searching and backup, but require robust systems and data protection measures. Many organisations use a hybrid approach.
RIDDOR regulations require you to keep records of reportable incidents for 3 years. However, it's strongly recommended to keep all accident records for at least 6 years (the limitation period for civil claims). For incidents involving potential long-term health effects or hazardous substance exposure, consider keeping records much longer or indefinitely.
Yes. Keep training records for at least 6 years after an employee leaves. Former employees can bring claims for work-related injuries or illnesses, and you'll need to prove you provided appropriate training. For work involving hazardous substances or serious risks, consider keeping records even longer.
Failure to keep required records is a breach of specific health and safety regulations. HSE can issue improvement notices requiring you to establish proper record keeping systems. Continued failure can lead to prosecution with unlimited fines. More significantly, lack of records means you cannot prove you met your duties, which weakens your defence in any civil or criminal proceedings.
Yes, you must keep employers' liability insurance certificates for 40 years. This is a legal requirement. Claims for occupational diseases and injuries can be made decades after exposure, so you need to prove you had valid insurance covering the relevant period. Many employers mistakenly discard old certificates.
Yes, once the retention period has passed, you can dispose of records. However, for records containing personal data, you must dispose of them securely (shredding, secure deletion) to comply with data protection law. Many organisations choose to keep records longer than the minimum, especially for serious incidents or hazardous exposures.
Store records securely where authorized personnel can access them when needed. For paper records, use locked filing cabinets in a secure location. For digital records, use secure servers or cloud storage with appropriate access controls and backups. Medical and health surveillance records must be kept separately with restricted access due to their confidential nature.
Under the Data Protection Act 2018, accident book entries should record: date and time of incident, name of injured person (can be removed/covered after entry for privacy), details of the injury, what happened, and the first aid or treatment given. Keep personal details (like home address) separate to protect privacy.
Some records are required regardless of business size (e.g., RIDDOR records, employers' liability insurance). The exemption from written records applies mainly to risk assessment findings and policy documentation. However, keeping written records even as a small business is strongly recommended for your own protection.
Health and safety records often contain personal data, which must be handled in accordance with UK GDPR. Key steps: only collect necessary information; keep records secure with appropriate access controls; don't keep records longer than necessary (but respect minimum retention periods); ensure employees know what you're recording; allow individuals to request copies of their data; dispose of records securely when retention period expires.
Checklist: Are your health and safety records complete?
Use this checklist to verify you're keeping all required records:
Risk Management:
- Written risk assessments for all significant hazards
- Risk assessment review dates recorded
- Action plans from risk assessments
- Evidence of actions completed
Accidents and Incidents:
- Accident book maintained and accessible
- RIDDOR reports kept for required period
- Near-miss reports recorded
- Investigation reports for serious incidents
- First aid treatment records
Training and Competence:
- Induction training records for all staff
- Job-specific health and safety training records
- Fire warden/marshal training
- First aid training and certificate renewal dates
- Training matrix showing what each employee needs
- Records kept for at least 6 years after staff leave
Equipment and Maintenance:
- Equipment inspection and test records
- PAT testing records and due dates
- Lifting equipment examination certificates (LOLER)
- Fire alarm weekly tests
- Emergency lighting monthly tests
- Fire safety equipment service records
- Maintenance logs for critical equipment
Health Surveillance:
- Health surveillance records (if required)
- Stored securely and separately from general records
- Retention period appropriate (40 years for COSHH, noise, asbestos)
Inspections and Monitoring:
- Workplace inspection reports
- Safety audit findings
- Action plans from inspections
- Environmental monitoring (noise, dust, fumes if applicable)
Consultation and Communication:
- Health and safety committee meeting minutes
- Employee consultation records
- Evidence of policy communication to staff
Contractors:
- Pre-qualification information for contractors
- Contractor risk assessments and method statements
- Contractor induction records
- Permit to work records
Insurance and Compliance:
- Current employers' liability insurance certificate displayed
- All historic employers' liability certificates archived (40 years)
- Health and safety policy (if 5+ employees)
- Specific assessments (COSHH, fire, manual handling, DSE as applicable)
Record Management:
- Records index showing what you keep and where
- Backup system in place for digital records
- Retention periods documented and followed
- Review schedule for records
- Data protection measures for personal information
Next steps
If your health and safety record keeping needs improvement:
Step 1: Conduct a records audit
Review what records you currently keep and identify gaps against legal requirements and this checklist.
Step 2: Prioritize critical records
Start with mandatory records that carry the highest legal obligation:
- Employers' liability insurance
- RIDDOR reports
- Risk assessments
- Training records
Step 3: Choose your storage method
Decide whether to use paper, digital, or hybrid approach. Set up the necessary filing systems or software.
Step 4: Create templates
Develop standardized forms for recurring records like:
- Accident reports
- Training sign-off sheets
- Inspection checklists
- Risk assessment forms
Step 5: Assign responsibilities
Make clear who is responsible for creating, maintaining, and reviewing each type of record.
Step 6: Implement retention schedule
Document how long each type of record must be kept and set up systems to archive or dispose of records appropriately.
Step 7: Train staff
Ensure everyone responsible for record keeping understands what's required, how to complete records accurately, and where to store them.
Step 8: Monitor and review
Regularly audit your record keeping to ensure it's working. Adjust your system based on experience.
Need help establishing a compliant record keeping system for your organisation? A health and safety consultant can assess your requirements, set up appropriate systems, and train your staff on maintaining accurate records.
Related articles:
Useful tools: