How Long to Keep Employee Training Records

Last updated August 2026.

There is no single federal retention period for employee training records. The requirement depends on which rule the training was delivered under. OSHA bloodborne pathogens training records must be kept 3 years from the date of training. HIPAA documentation must be kept 6 years. Employee exposure records under OSHA 1910.1020 must be kept 30 years. Personnel records under Title VII must be kept 1 year. Most OSHA training standards set no retention period at all, which is why the practical answer for a US employer is to keep every training record for the longest period that could apply to that employee, and never less than 3 years.

This is one of those questions that looks like it should have a one-line answer and does not. Ask three compliance managers how long to keep training records and you will get three different numbers, all defensible, because they are each thinking about a different regulation. Below is the actual rule text, organized by the record you are holding, plus what a defensible record has to contain and where most companies lose them.

How long do you have to keep employee training records?

Sort by the rule that generated the training, not by the department that delivered it. These are the periods written into the federal regulations, current as of August 2026.

Two entries in that table do most of the damage in practice. The first is the 1-year personnel record rule, which sounds generous until you read the rest of it: if a discrimination charge is filed, the employer must preserve all personnel records relevant to that charge until final disposition of the charge or the litigation. A one-year policy plus a charge filed in month eleven means you are now holding records indefinitely, and the clock is not yours to set.

The second is the last row. Most OSHA training standards, including hazard communication, lockout and tagout, personal protective equipment and fall protection, tell you to train and to verify that training happened, and then say nothing about how long to keep the proof. That silence is not permission to discard it.

The 30-year rule that catches employers out

Under 29 CFR 1910.1020, employee exposure records must be preserved for 30 years, and employee medical records for the duration of employment plus 30 years. That is not a training rule, and that is exactly why it surprises people.

The trap is that training, exposure monitoring and medical surveillance for the same hazard are usually generated by the same program and stored in the same place. A respiratory protection program produces fit test records (kept until the next test), medical evaluations (duration of employment plus 30 years) and annual training records (no stated period). If your retention policy applies one number to the whole folder, you are either destroying medical records decades early or storing everything for 30 years because nobody wanted to separate them.

Compare that to what most LMS vendors offer. Platforms in this category commonly default to around two years of history, and extending it is frequently a paid conversation rather than a setting. If you are in a regulated environment, retention depth belongs on the evaluation list next to price. Our LMS comparison covers what to ask each vendor, and OSHA annual training requirements covers which courses actually recur every year and which do not.

Where the rules say nothing, and what to do instead

For the majority of workplace training, no statute sets a number. You still need a policy, because in an inspection or a lawsuit the absence of a record functions as evidence that the training did not happen. Three anchors are worth building a policy around.

• The longest applicable rule for that employee. If a warehouse worker takes forklift, hazcom and bloodborne pathogens training, the folder is governed by the longest period that touches any part of it, not the shortest.
• The statute of limitations for the claim you are defending. Personal injury and employment claims commonly run two to three years in most US states, and a wrongful death or toxic exposure claim can surface far later. A training record you discarded at 3 years is a record you cannot produce at 4.
• The duration of the credential plus a margin. If a certification is valid for three years, keeping only the current one destroys the history that shows the person was continuously qualified. Auditors ask about the gap between certificates, not just the current one.

For ethics and conduct programs specifically, the Department of Justice Evaluation of Corporate Compliance Programs asks prosecutors to assess whether a company conducts periodic training and certification for directors, officers, relevant employees and, where appropriate, agents and business partners. It never names an interval. What it evaluates is whether you can demonstrate the program ran, which is a records question rather than a curriculum question. We cover the mechanics of that in code of conduct attestation.

A practical note on OSHA Outreach cards, because it is the most common real-world retention failure we see. Federal OSHA 10 and OSHA 30 cards carry no expiration date. But a replacement card can only be issued if the class was taken within the last five years, and only once per student per class. So the credential never expires and becomes effectively unprovable after five years if the employee loses the card and you did not keep a copy. Does OSHA 10 expire works through the state and city rules that layer on top of that.

What a defensible training record has to contain

Retention length is only half the requirement. A record that survives ten years but cannot answer the auditor's question is not worth the storage. The bloodborne pathogens standard is the most explicit federal example of what a training record should hold, and it is a good template even for training that falls under no specific rule. Under 1910.1030(h)(2)(ii), the record must include:

• The dates of the training sessions
• The contents or a summary of the training sessions
• The names and qualifications of the persons conducting the training
• The names and job titles of all persons attending the training sessions

Read that list against a typical LMS completion export and the gaps show up fast. Most platforms give you a name, a course title and a completion date. Fewer store what the course actually contained on the day it was taken, which matters when the course has been revised twice since. Fewer still store who delivered instructor-led sessions and what qualified them to.

The version problem is the one that ends audits badly. If an employee attested to a policy in 2024 and the policy has been rewritten twice, a record showing "acknowledged Code of Conduct" proves nothing about what they actually read. A defensible record pins the completion to a specific document version, not to a document name.

Why spreadsheets fail the retention test

Almost every company we talk to started with a spreadsheet, and most of them are honest about why it stopped working. It is rarely the tracking. It is the retrieval, years later, under pressure.

The failure pattern is consistent. The person who maintained the sheet leaves. The file gets copied, and now two versions disagree. Nobody can prove which cell was edited when, or by whom, which is exactly what an auditor probes when the stakes are high. And when a specific request arrives, whether that is an OSHA inspector asking for one employee's history or an employee exercising a right to see every record you hold about them, somebody spends a day in file shares reconstructing an answer that should take thirty seconds.

What replaces it does not need to be complicated. It needs a dated, per-employee record that cannot be edited without a trail, a retention window you set rather than inherit, certification expiry dates with reminders that fire before the lapse rather than after, and an export a compliance officer can hand over without reformatting. Our certification tracking software page covers how that record should be structured, the best certification tracking software compares platforms on exactly those criteria, and how to track employee certifications covers the workflow.

Frequently asked questions

How long to retain employee training records?

Keep them for the longest period that could apply to that employee, and never less than 3 years. Three years matches the explicit OSHA bloodborne pathogens requirement and covers the statute of limitations for most employment and injury claims in most US states. Where HIPAA applies, the floor rises to 6 years. Where exposure or medical records are involved, it rises to 30.

How long to keep employee safety training records?

Most OSHA safety training standards set no retention period, so the practical floor is 3 years, matching the bloodborne pathogens rule. Raise it to 30 years for anything connected to employee exposure records under 1910.1020. Respirator fit test records are the exception in the other direction: the standard only requires keeping them until the next fit test is administered.

How long do employers keep employee records?

Under 29 CFR 1602.14, personnel and employment records must be preserved for 1 year from the date the record was made or the personnel action was taken, whichever is later, and for 1 year from the date of an involuntary termination. If a discrimination charge or an action is filed, all relevant personnel records must be preserved until final disposition of that charge or litigation, which can extend the period by years.

Are electronic training records acceptable to OSHA?

Yes. OSHA does not require paper, and electronic records are acceptable provided they are complete, accurate and can be produced on request. The E-SIGN Act separately establishes that a signature is not denied legal effect simply for being electronic. The weak point in electronic records is not the format, it is version control: a record that cannot prove which version of a document or course the employee actually saw is difficult to defend.

What happens if you cannot produce a training record?

In an OSHA inspection, the practical effect is that the training is treated as not having happened, because the standard requires the employer to be able to verify it. That converts a documentation gap into an alleged training violation. In civil litigation the effect is worse, since a missing record you had a duty to preserve can support an adverse inference against you.

Should training records follow an employee who leaves?

The records stay with the employer, and the retention clock usually keeps running after departure. Personnel records for an involuntarily terminated employee must be kept 1 year from the termination date under 29 CFR 1602.14, and employee medical records under 1910.1020 must be kept for the duration of employment plus 30 years. Purging a leaver's file at exit is one of the more common and more expensive retention mistakes.