How Long to Keep Health and Safety Records in the UK

4 August 2026

How long to keep health and safety records in the UK? It depends on the record, and the range is wider than most people expect: from two years for a lifting accessory report to forty years for anything that touches asbestos. There is no master retention period. Each regulation sets its own clock, and some of those clocks run longer than the average construction business exists.

The table below sets out the main ones. Every period comes from the regulation named alongside it; where the law sets no period, the entry says so rather than inventing one.

How Long to Keep Health and Safety Records: The Table

Managing compliance in a spreadsheet?

ComplianceVault replaces the scramble. Free to get started, no card needed.

View pricing →

Record	Minimum retention	Source
RIDDOR incident records	3 years from the date the record was made	RIDDOR 2013, Regulation 12
Accident book entries	3 years from the date of entry	Social Security (Claims and Payments) Regulations 1979
COSHH exposure monitoring (general workplace)	5 years	COSHH Regulations 2002, Regulation 10
COSHH monitoring tied to an identifiable employee	40 years	COSHH Regulations 2002, Regulation 10
COSHH health surveillance records	40 years from the last entry	COSHH Regulations 2002
Asbestos health records and linked air monitoring	40 years	Control of Asbestos Regulations 2012
LOLER thorough examination reports (lifting equipment)	Until the next report, or 2 years, whichever is later	LOLER 1998
LOLER reports for lifting accessories	2 years	LOLER 1998
PUWER inspection records	Until the next inspection is recorded	PUWER 1998, Regulation 6
Risk assessments	No statutory period; keep the current version live and superseded ones for as long as claims could arise	Management of Health and Safety at Work Regulations 1999
Training records	No statutory period; keep for the length of employment plus a sensible margin	HSE guidance on demonstrating competence
Employers' liability insurance certificates	No statutory period since 2008; HSE still recommends keeping them (the old rule was 40 years)	Employers' Liability (Compulsory Insurance) (Amendment) Regulations 2008

Three clarifications, because the table hides some traps.

First, the COSHH split matters. Background air monitoring for a workshop is a five-year record. The moment a result can be linked to a named operative, Regulation 10 turns it into a forty-year record. Same sensor on the same day, but a very different filing obligation.

Second, the accident book and RIDDOR are separate duties. An entry in the BI 510 satisfies the social security regulations; a reportable injury also needs its own RIDDOR record. Keep both.

Third, that insurance row deserves its own section, which it gets below.

Why Some Records Outlive the Business

The forty-year periods exist because occupational disease takes its time. Under the Limitation Act 1980, a personal injury claim generally has to be brought within three years, but for industrial disease the clock starts at the date of knowledge, which for most claimants means diagnosis rather than exposure. Someone who cut asbestos cement boards in the 1990s may only learn what that did to their lungs this year. The record proving what they were exposed to, and what protection they were given, has to still exist when they do.

Employers' liability insurance follows the same logic. The statutory requirement to keep certificates for forty years was removed in October 2008, but HSE guidance still recommends holding on to them, because the insurer that was on cover during the exposure is the one that answers the claim decades later. The Employers' Liability (Compulsory Insurance) Act 1969 makes at least £5 million of cover a legal requirement, and the certificate is what ties a specific insurer to a specific year; once it is lost, working out who was on risk gets a great deal harder. We've covered what happens when insurance expires on site and the full set of construction insurance requirements separately. Retention is the quieter half of the same discipline.

Paper, Digital and the Retrievability Test

Almost every regulation in the table allows electronic records. HSE's position on RIDDOR and PUWER records is that any format is acceptable, provided the record can be produced when an enforcing authority asks.

That word "produced" carries a lot of weight. Picture the letter that arrives six years after a job finished: a solicitor acting for a former operative wants your COSHH assessments and training records for a site you demobbed in 2020. An archive box in the unit behind the yard is technically a record. Whether it survives two office moves and one burst pipe is another question. So is the spreadsheet on the laptop of someone who left in 2022.

The same test applies in friendlier circumstances. A main contractor's vetting portal wanting three years of accident history doesn't care if your records are paper or digital. It cares whether you can lay hands on them before the deadline. Digital storage wins here, but only if the files are properly named and kept in one place. Ten thousand photos called IMG_4712 is a landfill, not an archive.

The accident book deserves a separate mention. Completed pages contain personal data, so they need storing somewhere access-controlled, not in the site canteen next to the kettle.

What You Can Safely Bin

Retention guidance dwells on what to keep. The other side gets less attention. You can usually let go of:

Lifting accessory examination reports older than two years, where the accessory itself is long gone
PUWER inspection sheets once the next inspection is recorded, although a rolling history costs nothing to keep digitally and reads well in an audit
Duplicate copies, once you've confirmed the original is stored and backed up
Superseded drafts of RAMS where the final signed version is retained. The current version of a risk assessment stays live for as long as the work continues; the marked-up draft of version two does not

The rule of thumb before anything meets the shredder: if the record names a person and an exposure, keep it. Forty years is the law's way of telling you which documents matter most, longest.

Expiry Is the Other Half of the Job

Retention looks backwards: proving what happened, sometimes decades after it happened. But every folder of compliance paperwork also has a forward-facing problem, because much of it is heading towards a date on which it stops being valid. Documents die quietly. Insurance certificates lapse, waste carrier licences run out, and the SMSTS ticket that got your supervisor through the gate check last month has an expiry printed on it too. The free expiry checker on this site will tell you which of your current certificates and tickets are closest to the edge.

Knowing when a document dies matters as much as knowing how long to keep it, and it's the half that gets you turned away at the gate rather than surfacing in litigation. Tracking both halves is the job ComplianceVault was built around: a renewal reminder on each evidence type at whatever notice suits it, up to 90 days before expiry, plus a permanent free plan that never asks for card details.

If the backlog needs a starting point, make it the forty-year pile. Scan the asbestos and COSHH surveillance records first and give the files names a stranger could search for in 2060. The rest of the table can follow at whatever pace the day job allows.