How Long Should Food Safety Records Be Kept?

There is no single retention period that applies to every food safety record. The correct period depends on what the record proves, the type of food, applicable traceability or sector rules, customer requirements and how long the evidence may reasonably be needed for an inspection, complaint, food incident or HACCP review.

Where TapTick fits: Digital records make it easier to apply consistent retention rules while keeping historic checks, exceptions and corrective actions searchable for inspection or review. See TapTick’s record-keeping features.

Why there is no single retention period for all food safety records

Food businesses often ask for one number: three months, one year, two years or three years. That is understandable, but it can produce a weak policy because different records serve different purposes.

For example:

• a current HACCP plan needs to remain available while it is in use;
• an old version may need to show what controls applied before a process changed;
• daily temperature monitoring may be needed to demonstrate that controls operated over time;
• a corrective-action record may become important during a complaint or incident;
• traceability information may have specific legal retention rules depending on the food and jurisdiction;
• training, calibration or verification records may need to support a later audit of the system.

FSAI's HACCP guidance says appropriate documentation and records must be kept and readily available, with the complexity proportionate to the nature and complexity of the business. UK MyHACCP guidance likewise tells businesses to consider how long records should be retained in light of matters such as product shelf-life and possible misuse.

That means the better question is: how long could this particular record reasonably be needed to demonstrate control or traceability?

Separate your records into practical groups

A retention policy is easier to defend when it distinguishes between record types.

HACCP plans and controlled procedures

Keep the current approved version while it applies. When a process, product or control changes, retain enough version history to show what procedure was in place previously and when the change occurred.

Daily monitoring records

These include temperature checks, cooking records, hot-hold checks and other routine monitoring. The retention period should be long enough to support verification, inspection and investigation of food that may still be relevant after the day of production or sale.

Corrective actions and incidents

Failed checks, food-safety incidents, complaints, product withdrawals and corrective actions can remain relevant longer than an ordinary successful daily check. They may be needed to demonstrate the response, root cause and preventive action.

Verification and review

Keep evidence that the food-safety system was checked and reviewed: audits, management reviews, probe calibration, validation, verification and HACCP updates.

Training and competence

Training records should support the period during which the person carried out the relevant food-safety duties and any later need to demonstrate competence or instruction.

Traceability records

These deserve their own rule because specific requirements can apply to supplier, customer, batch and foods-of-animal-origin information.

What does Irish guidance say about traceability record retention?

FSAI makes clear that traceability retention is not one universal period for every food business.

Its traceability FAQs explain that, depending on the legal framework applying to the business:

• some traceability records must be maintained at least until it can reasonably be assumed that the food has been consumed; and
• certain businesses handling foods of animal origin must maintain traceability records for three years.

FSAI's main traceability page also states that more detailed records are required for foods of animal origin and describes a minimum three-year period in that context, with longer retention where the shelf-life itself exceeds three years.

This is why a blanket “delete everything after 12 months” rule can be dangerous. A business first needs to identify which specific traceability provisions apply to its activities and products.

What does UK HACCP guidance say?

UK MyHACCP guidance does not give one universal retention number for all HACCP records. Instead it asks businesses to decide an appropriate retention period, considering matters such as the shelf-life of the product and how the product may be used.

Its examples of records include:

• CCP monitoring;
• deviations and corrective actions;
• verification procedures;
• HACCP plan modifications;
• training;
• daily records and inspection reports;
• processing records.

The underlying principle is that documentation should be sufficient to verify that controls are in place and maintained. The retention period should therefore support that purpose rather than being selected only to minimise storage.

Why shelf-life matters, but is not the only factor

Shelf-life is a useful starting point because a food-safety issue may emerge after manufacture or sale. But it is not always the end of the analysis.

Consider whether:

• the product may be frozen by consumers;
• the product has a long ambient shelf-life;
• the business sells ingredients used in other products;
• customer or certification requirements set longer periods;
• the record supports an incident or corrective action that remains open;
• the record is needed for a scheduled audit or official control;
• another legal requirement applies to the particular record type.

Retention should also be proportionate. Keeping every low-value record forever can make retrieval harder and create unnecessary data-management burdens.

How to create a practical food-safety record retention policy

1. Inventory the records you actually keep

List every food-safety record type rather than writing a policy around broad labels such as “HACCP paperwork”. Include digital systems, supplier documents and records held centrally or by individual sites.

2. Identify any specific requirement

For each record, check applicable food law, sector guidance, customer standards, certification requirements and your own HACCP system. Where a precise minimum applies, record it explicitly.

3. Define the operational reason for keeping it

Ask what the record may need to prove: routine monitoring, traceability, training, verification, corrective action, incident response or another control.

4. Set a clear retention rule

Use a defined period or event-based rule such as “for the stated period after the record date”, “for the product shelf-life plus the defined margin” or “while current plus the defined superseded period”. Avoid vague instructions such as “keep old records for a while”.

5. Define where the record lives

Specify whether the authoritative copy is paper, local digital storage or a central system. Duplicate uncontrolled copies make it difficult to know what should be retained or deleted.

6. Pause deletion when an incident is relevant

If a complaint, investigation, withdrawal, legal issue or authority request concerns a record, preserve it even if routine deletion would otherwise be due. The incident should take precedence until the evidence is no longer required.

7. Review the policy when the business changes

New products, longer shelf-lives, central distribution, new customer standards or a change in the food-safety system can all change the appropriate retention period.

Digital records: retention is more than storage space

Digital systems remove the physical problem of filing cabinets, but they still need a defined retention approach.

Check that your system can:

• retain records for the period your policy requires;
• keep records accessible when staff or managers change;
• search by site, date, task and status;
• preserve failed results and corrective actions;
• distinguish the original record from later amendments;
• export evidence in a readable format;
• apply controlled deletion when the retention period ends;
• prevent routine deletion where records are on hold for an incident or investigation.

For more on the format itself, see Digital HACCP vs Paper Records: What Do Food Inspectors Accept? and What Food Safety Records Does an EHO Want to See?

Food-safety record retention checklist

• Every food-safety record type is listed.
• Traceability records are considered separately from routine monitoring.
• Any specific legal or sector minimum is documented.
• Product shelf-life and foreseeable use are considered.
• Corrective-action and incident records are not deleted while still relevant.
• Current and superseded HACCP documents are controlled.
• The authoritative storage location is defined.
• Managers can retrieve historic records during inspection.
• Digital deletion is controlled rather than accidental.
• The policy is reviewed when products, processes or requirements change.