How Long Must You Keep COSHH Records and SDS?

There is no single retention period for every COSHH document. Under COSHH, personal exposure-monitoring records and health-surveillance health records can require 40-year retention, other exposure-monitoring and control-test records commonly require at least five years, while assessments and SDS should be kept under a documented policy that preserves the evidence needed for current and historical risk management.

This is general guidance, not legal advice. Check the precise regulation and any substance-specific regime that applies to your work.

What are the main COSHH retention periods?

The table separates legal minimums from prudent document control. “Keep everything for 40 years” is simple but inaccurate, while deleting every superseded document as soon as a new one arrives can destroy useful evidence.

How long must COSHH assessments be kept?

Employers with five or more employees must record the significant findings of a COSHH assessment. HSE says the assessment should be reviewed regularly and when it may no longer be valid, including after changes to staff, processes, substances or equipment.

COSHH does not give every ordinary assessment a universal 40-year retention period. Keep the current assessment available for the people who need it, then apply a documented policy to superseded versions.

Historical assessments may be important when they show:

• Which task and formulation were assessed at a particular time.
• What controls were selected and why.
• Whether exposure monitoring or health surveillance was considered.
• What changed after an incident, near miss or control failure.
• Which employees or contractor groups may have performed the work.
• How a later review responded to new evidence.

Do not confuse review with overwriting. A controlled superseded version can preserve the old decision while the current version guides today's work.

How long should safety data sheets be kept?

The operational SDS should match the product, supplier and formulation currently in use. When a supplier issues a revision, check the changes, update affected records and make the new version available.

There is no single COSHH rule saying every SDS must be kept for 40 years. However, an old SDS may be the clearest evidence of the classification, ingredients and supplier advice that applied during historical use.

Keep superseded SDS when they support:

• Long-latency exposure or health-surveillance records.
• An incident, claim or regulatory investigation.
• Understanding a supplier reformulation.
• Historical COSHH or DSEAR assessments.
• Waste, contamination or decommissioning work.
• Product traceability where the trade name stayed the same.

An archive should label superseded documents clearly so workers do not mistake them for current instructions. Record product code, supplier and SDS revision or issue date; a filename containing only the trade name is weak control.

Which exposure-monitoring records require 40 years?

Regulation 10 of COSHH requires a suitable exposure-monitoring record to be made and maintained where monitoring is carried out under that regulation. The HSE COSHH Approved Code of Practice states that the record or a suitable summary must be kept:

• For at least 40 years where it represents the personal exposures of identifiable employees.
• For at least five years in any other case.

Both periods run from the date of the last entry. The distinction is important: a personal air-monitoring result tied to a named worker is treated differently from an anonymous area survey.

Where an employee is under health surveillance, the regulation also requires an individual record of relevant monitoring to be made and kept for that employee.

How long must health-surveillance records be kept?

HSE's health-surveillance record-keeping guidance says health records must be kept for at least the period in the relevant regulation, giving 40 years under COSHH as an example.

A health record is not the same as a medical record. The employer's health record contains details such as the worker, workplace hazards, surveillance performed and fitness outcome. It should not contain confidential clinical details without the worker's written consent.

Medical records, clinical notes and test results are held in medical confidence by the occupational health professional. Access, transfer and retention should be handled through the occupational health arrangement rather than a general chemical-document folder.

If a business changes provider or ceases trading, plan the lawful transfer of records before access is lost. HSE guidance also recommends offering workers a copy of their health record when they leave or if the business ceases trading.

How long should control-measure test records be kept?

Controls such as local exhaust ventilation, respiratory protective equipment and other engineering measures require appropriate examination, maintenance and testing.

HSE's control-measure guidance says records of examinations, tests and repairs to equipment should be kept for at least five years. This history helps identify declining performance and recurring faults.

A record should identify the equipment, test date, person or organisation carrying out the work, result, defect, repair and return-to-service decision. Keep enough detail to understand whether the control was effective, not merely that a visit took place.

When does the retention clock start?

The COSHH regulation 10 periods for monitoring run from the date of the last entry in the record. A health record is maintained over the surveillance period and retained according to the applicable requirement after the last entry.

For ordinary assessments and SDS archives, define the trigger in your policy. Possible triggers include last use, last purchase, last assessment review or removal of the final container. Choose one that can be applied consistently and does not break links to longer-lived monitoring or health records.

What should a retention policy contain?

A workable policy specifies:

1. Record category and legal or operational purpose.
2. Minimum period and the event that starts the clock.
3. Named record owner and approved storage location.
4. Access controls, especially for worker health information.
5. Links among product, SDS, assessment, monitoring and surveillance.
6. Rules for legal hold, incidents and claims.
7. Secure disposal method and evidence of deletion when due.
8. Arrangements for staff departure, provider change or business closure.

Privacy and safety duties should be reconciled rather than treated as opposites. Retain required information, restrict access to those with a legitimate need and avoid storing unnecessary clinical detail in general safety files.

How should digital COSHH records be archived?

Use versioned, read-only superseded records rather than folders called “old”. Preserve metadata such as issue date, approval date, product code, supplier and the assessment activities covered.

Backups are not an archive by themselves. A backup restores a system after failure; an archive lets authorised users retrieve a specific historical record and understand its status.

The Safe Foundry workflow connects SDS information to assessment records, and the feature overview shows document-management capabilities. Use the help centre for product guidance.

What is the practical rule?

Keep current documents usable, preserve legally required records for their full period and retain superseded SDS and assessments where they explain historical exposure or decisions. Apply the rule by record type, not by repeating “40 years” across the whole chemical file.