Permit Records: What to Keep and How Long

There is no single statutory retention period for permits to work. HSE guidance sets a clear minimum for the on-site period — 30 days after completion — and then hands the archive period back to you to define. That gap is where most sites end up either keeping nothing usable or keeping everything forever in a way nobody can search.

This guide covers what the guidance actually says, what other records travel with the permit, and how to set an archive period you can justify.

This guide covers UK requirements and references HSE guidance. Legislation and standards may differ in other jurisdictions.

What HSE guidance says

The operative passage in HSG250 is paragraph 58:

"Permits-to-work, certificates and risk assessments should be retained at site by the issuing authority for at least 30 days after completion, and then archived for a specified period to enable an effective monitoring and audit process."

Three things are doing work in that sentence.

"Permits-to-work, certificates and risk assessments." Not just the permit. The isolation certificate and the risk assessment it references are part of the record. Filing the permit alone leaves the evidence incomplete — the permit says precautions were taken, and the certificate is what shows which.

"At site … for at least 30 days." On site, not at head office, and held by the issuing authority. The reason is practical: the period immediately after completion is when a problem is most likely to surface, and the record needs to be reachable by the people who can act on it.

"Archived for a specified period." A specified period — HSG250 does not set a number. It requires you to have one, and to have chosen it. A site that has never decided has not met this, even if it happens to have kept everything.

HSG250 also places the record-keeping duty on the employer: the site occupier should ensure that "copies of permits, or records of their issue, are kept for a specified period to enable auditing or incident investigation." Note or records of their issue — the register itself is part of what is retained, not only the individual forms. Our permit to work register guide covers what that register should hold.

What else has to be kept

The permit is the centre of a small bundle. In practice, retain together:

• The permit, including all signatures through to cancellation
• Any isolation or other certificates cross-referenced on it
• The risk assessment the permit's controls came from
• The register entry, showing issue and close-out times
• Any suspension or extension records, which are often on separate sheets
• Monitoring records — HSG250 says these "should be archived on site, and reviewed during periodic permit-to-work audits"

Filing these separately is the most common practical failure. Six months later the permit is findable and the isolation certificate it references is in a different drawer, so the record proves less than it should.

The related statutory duties

No statute prescribes a permit retention period, but two duties commonly sit alongside.

Risk assessment records. Regulation 3(6) of the Management of Health and Safety at Work Regulations 1999 provides: "Where the employer employs five or more employees, he shall record— (a) the significant findings of the assessment; and (b) any group of his employees identified by it as being especially at risk."

That is a duty to record, not a stated retention period — but since HSG250 wants the risk assessment archived with the permit, the two travel together.

Construction projects. Under CDM 2015 regulation 12, the health and safety file must contain "information relating to the project which is likely to be needed during any subsequent project to ensure the health and safety of any person," and at the end of the project "the principal designer, or where there is no principal designer the principal contractor, must pass the health and safety file to the client."

Not every permit belongs in the file — a routine cold work permit generally does not. Permits recording something a future project needs to know about, such as an unexpected buried service or a non-obvious isolation point, generally do. The test in the regulation is the phrase above: likely to be needed during any subsequent project.

Setting your archive period

HSG250 requires a specified period and leaves the number to you. Four inputs to the decision:

Your audit cycle. The archive exists partly "to enable an effective monitoring and audit process." HSG250 recommends system reviews "undertaken at least every three years." An archive shorter than your review cycle cannot support the review.

Investigation horizon. Incidents are sometimes investigated long after the work. Permits are among the first documents requested.

Latency of harm. This is the one that moves the number most. Where permitted work could involve exposure with long-latency health effects — asbestos, respiratory sensitisers, certain chemicals — records may need to be kept far longer than the general case, and sector-specific requirements apply. Check the requirements for the substances your work actually involves rather than applying a general period to everything.

Sector and client requirements. Major hazard sites, and many principal contractors' own contract terms, impose longer periods than you would otherwise choose.

Write the number in your permit to work procedure with the reasoning next to it. A period you can explain is defensible; a period nobody can account for is the thing an auditor pulls on.

⚠️ A caution on general retention figures. Numbers like "keep permits for five years" circulate widely and are not stated in HSG250. They are conventions, not requirements, and applying one to work involving long-latency health risk can be badly wrong. Set your period against the four inputs above and the specific requirements for your sector and substances — do not inherit a figure from a template.

Making the archive usable

An archive that satisfies retention but cannot be searched fails the purpose the guidance gives it. The practical test is whether you can produce a named permit from eight months ago in under five minutes.

Whatever the format, index on the four things people actually search by:

• Date range — the most common
• Location or plant — "what was happening in Zone 3 that week"
• Permit type — for audit sampling
• Person — issuer or acceptor, usually during an investigation

Paper archives are fine if boxed by month and labelled. The failure is not paper; it is unindexed paper. If you are moving formats, our guide to moving from paper permits to digital covers what to do with the historic pile — and the short answer is usually to leave it alone and record the cut-over date.

Scanning does not license destroying originals unless you have decided that deliberately and your sector permits it. Keep the cut-over date written on the front of the archive box, so anyone investigating a period that spans it knows which system holds what.

A short checklist

• Permits held on site by the issuing authority for at least 30 days after completion
• Certificates, risk assessments and monitoring records archived with the permit, not separately
• An archive period specified in writing, with the reasoning recorded
• A longer period identified for work involving long-latency health risk
• The register retained as well as the individual permits
• Permits relevant to future work routed into the CDM health and safety file where the project is in scope
• The archive indexed by date, location, permit type and person
• Retrieval tested — pick a permit from six months ago and time it

That last one is the only real test. Everything above it is arrangement; the retrieval is the outcome. Our permit to work audit guide covers where record-keeping sits in a wider system audit.

PermitPad is building a permit-to-work system where the permit, its certificates and its register entry stay together, and retrieval is a search rather than a hunt. Join the waitlist to see it when it launches.

Key references

• HSG250: Guidance on permit-to-work systems — HSE, first edition 2005. Paragraph 33 (employer duty to keep records of issue), paragraph 58 (30 days on site, then archive), paragraphs 59 and 63 (monitoring records, three-yearly review). Guidance, not law
• Management of Health and Safety at Work Regulations 1999, regulation 3 (SI 1999/3242) — the duty to record significant findings where five or more employees are employed
• CDM 2015, regulation 12 (SI 2015/51) — the health and safety file, its contents and its transfer to the client at project end

Disclaimer

This guide is for general information only. Retention requirements depend on your sector, the substances and hazards involved, and any client or contractual obligations — and work with long-latency health effects may require far longer retention than general practice. Always consult a competent H&S professional and the applicable legislation and sector guidance for your circumstances.