Data Retention and GDPR
Accident records contain personal data, so UK GDPR says you shouldn’t keep them for longer than you need to. Accident Book can anonymise or delete old records for you automatically.
Where your data is stored
Your incident records and photos are stored in the UK, in a London data centre.
Setting a retention policy
- Go to Settings and select System. Only admins can do this.
- Under Data Retention, turn on Apply a retention policy.
- Choose how long to keep incident records, from 3 years upwards. Seven years is a common choice.
- Choose what happens after that period: anonymise or delete.
- Check the preview, which shows how many incidents would be affected, then save.
The policy is off until you turn it on. Once it is on, Accident Book checks every day at 2:30am.
Anonymise or delete?
| Option | What happens |
|---|---|
| Anonymise (recommended) | Removes the names and contact details of everyone involved, witness details, the description, notes, actions and photos. Keeps the reference number, dates, site, severity and RIDDOR status, so your statistics and trends still work. |
| Delete | Permanently deletes the incident and everything linked to it, including photos, notes, actions and RIDDOR assessments. |
Neither can be undone.
How long should you keep records?
- Accident book entries and records of RIDDOR-reportable incidents must be kept for at least 3 years, so the shortest policy you can set is 3 years.
- Adults can usually make a personal injury claim up to 3 years after an accident. Children can claim until 3 years after they turn 18, so records about children may need keeping until they are 21.
- Your insurer may ask you to keep records for longer. Check your policy.
Keeping a particular incident
Open the incident and turn on Retention hold in Quick Information. Incidents on hold are never anonymised or deleted by the policy, for example while a claim is open. Only admins can change the hold.
Checking what has been done
The Data Retention settings show when the policy last ran and how many incidents and photos it processed. The dashboard’s GDPR status shows your current policy, and Generate GDPR Report downloads a summary.