Which health and safety records should a business keep?

Why a filing system needs more than a folder name

A current assessment that workers cannot find is of limited use. Equally, retaining every historic personnel document forever creates avoidable privacy and retrieval problems. The aim is to show what was assessed, decided, provided and checked, while preserving records for the periods that actually apply.

Distinguish the current working instruction from evidence of an earlier decision. Superseded material may need to be retained, but it should not be mistaken for the method staff must now follow.

Map each record to its purpose and owner

Use HSE’s policy guidance, risk-assessment guidance and training-record guidance to identify the relevant requirements and useful management evidence. A generic training log is not a substitute for every hazard-specific duty.

Use a retention schedule with the actual rule

These are GB examples, not a complete schedule for every business:

• PUWER inspection guidance: keep an inspection record at least until the next inspection.
• RIDDOR regulation 12: keep the required entry for at least three years from the date it was made.
• COSHH control guidance: relevant examination, testing and repair records for control equipment have a five-year requirement.
• Health-surveillance record guidance: applicable COSHH health records have a forty-year retention requirement.

These periods concern different records. Forty years is not the rule for all safety paperwork, and three years is not a safe default for all employee information. Confirm the duty and any other legitimate retention need before disposal. For NI, start with HSENI’s business guidance and the applicable NI provisions.

Separate employer records from confidential medical notes

HSE distinguishes employer health records from medical records. Managers do not need unrestricted access to confidential clinical notes to maintain the employer’s required health record.

Apply role-based access, suitable security and a documented disposal review. ICO storage-limitation guidance explains the need to justify personal-data retention by purpose and relevant requirements. Keep a note of the retention source and review date rather than relying on an unexplained deletion setting.

Example: turn a mixed folder into a controlled register

A restaurant has training certificates, a fridge maintenance report, an incident entry and a worker’s medical letter in one shared drive folder. The manager identifies each record’s purpose and owner, restricts sensitive access, separates confidential material and records the applicable retention source.

The maintenance defect remains linked to evidence of repair. The current instruction is easy to locate, while the superseded version is clearly marked. Before deleting an old record, the manager checks the schedule and any relevant legal or ongoing case requirements.

Minimum register fields

Record type; business purpose; legal or guidance source where relevant; owner; storage location; authorised access; retention trigger and period; next disposal review.

Next steps

Start with the records you already hold. Build the register, resolve uncertain retention rules with suitable advice and make current working instructions accessible to the people who need them.