Accident book retention is one of the most misunderstood parts of workplace compliance, largely because employers are given fragments of guidance rather than a clear principle to follow. Some organisations delete records too early in an attempt to be GDPR-compliant. Others keep everything forever out of fear. Both approaches create risk.
The reality is that UK law does not prescribe a single retention period for accident book records. Instead, employers are expected to keep records for as long as they are reasonably required, and no longer. Understanding what “reasonable” means in practice is where most businesses fall down.
Why accident book retention matters years later
Accident records almost never matter on the day they are created. They matter when time has passed.
Most disputes involving workplace accidents arise months or even years later, when memories have faded and staff have moved on. At that point, the accident book entry often becomes the only contemporaneous evidence of what actually happened. If it no longer exists, the employer is forced to rely on recollection, inference, or second-hand accounts.
Equally, if records are retained indefinitely with no justification, employers can find themselves exposed to data protection complaints or unable to explain why sensitive health information is still being held long after any risk has passed.
Retention decisions are rarely judged in isolation. They are judged retrospectively, under pressure.
Why there is no fixed legal timeframe
UK health and safety legislation deliberately avoids setting a fixed retention period for accident records. The law is based on proportionality and foreseeable risk, not arbitrary dates.
What regulators and courts look for is whether an employer could reasonably have anticipated a future need for the record. If a claim, inspection, or dispute was foreseeable, deleting the record early is difficult to defend. If no such need exists, keeping records indefinitely is equally problematic.
This is why blanket rules like “three years” or “delete after GDPR” are misleading. They oversimplify a decision that depends on context.
The role of personal injury claims
The most important factor in accident book retention is the limitation period for personal injury claims.
In many cases, an injured employee has three years to bring a claim. That often leads employers to assume that three years is the correct retention period. In practice, that is risky.
Claims are frequently raised close to the end of the limitation period. Some injuries take time to develop or be properly diagnosed. Others are disputed initially and only escalate later. Deleting records at the three-year mark can leave an employer without evidence precisely when it is needed most.
For this reason, many employers retain accident book records beyond the basic limitation period to protect against late or complex claims.
Why six years is widely used in practice
Although not mandated by law, a six-year retention period is commonly adopted by UK employers.
This timeframe is generally seen as defensible because it aligns with wider civil limitation principles, is accepted by insurers, and provides a buffer beyond the minimum injury claim window. It is long enough to cover most foreseeable disputes without drifting into indefinite retention.
Crucially, six years is not treated as a magic number. It is treated as a reasoned default, applied unless there is a clear reason to retain records for longer.
When longer retention is justified
Some accident records carry risk well beyond standard limitation periods.
This is particularly true where the injured person was a child or young person, where the injury may have long-term health implications, or where an occupational disease could emerge years later. In these cases, deleting records early can create serious exposure.
Similarly, incidents that were reportable under RIDDOR or involved serious harm often justify extended retention because regulatory or legal scrutiny can arise long after the event itself.
Retention should reflect the nature of the risk, not just the passage of time.
How GDPR actually applies to accident book retention
GDPR does not prohibit employers from keeping accident records for several years. It requires employers to be able to justify why the data is still held.
Accident book records usually contain health information, which is sensitive. That increases the expectation of care, but it does not shorten the lawful retention period. If an employer can demonstrate that records are retained to meet legal obligations, defend claims, or satisfy regulatory oversight, that is a legitimate basis for continued storage.
Problems arise when records are kept indefinitely without review, or when there is no documented rationale for retention at all. In those cases, the issue is not the length of time, but the lack of governance.
Guidance from the Information Commissioner's Office consistently emphasises justification over arbitrary deletion.
Why “keep everything forever” backfires
Some employers assume that retaining accident records indefinitely is the safest option. In reality, it often creates more problems than it solves.
Indefinite retention increases exposure during data breaches, complicates subject access requests, and makes it harder to demonstrate compliance with data protection principles. If an organisation cannot explain why decade-old accident records are still necessary, that itself becomes a compliance issue.
Retention should be deliberate, reviewed, and defensible. Not automatic.
What regulators actually expect to see
During inspections, the Health and Safety Executive is unlikely to challenge a well-reasoned retention policy, even if records are kept for several years.
What raises concern is inconsistency. Missing records, unexplained deletions, or wildly different retention practices across sites suggest a lack of control. That lack of control, rather than the specific retention period, is what draws scrutiny.
The principle employers should follow
Accident book retention is not about choosing the “right” number of years. It is about being able to explain your decision clearly.
If you can show that records were kept long enough to meet foreseeable legal and regulatory needs, reviewed periodically, and disposed of securely once those needs passed, you are in a strong position.
If you cannot explain why records were deleted or why they are still being held, you are not.
Key takeaway
There is no single legal answer to how long accident book records should be kept. There is, however, a clear expectation that employers act proportionately and deliberately.
Deleting records too early weakens your ability to defend claims. Keeping them forever creates unnecessary data protection risk. A clearly justified, reviewed, multi-year retention approach is what regulators, insurers, and courts expect to see.
That is what “compliant” actually looks like.