How Long Do You Need to Keep a Safety Data Sheet?

The commonly repeated "keep your SDS for 40 years" advice conflates the SDS itself with a different set of records COSHH does set a fixed period for: exposure monitoring records and health surveillance records. The SDS just needs to stay current and accessible for as long as the substance is in use. Keeping old versions afterwards is good practice, not a separate legal deadline with its own number attached.

Where the "40 Years" Claim Actually Comes From

The 40-year figure is real, it's just attached to the wrong document in most of the guidance repeating it. It comes from two places in the COSHH Regulations 2002: exposure monitoring records and health surveillance records. Neither of those is the SDS. They're records the employer generates, about what workers were actually exposed to and what health checks were carried out, not the hazard information the supplier sends with the product.

That distinction matters in practice. A supplier's SDS describes the substance in general terms. A health surveillance record describes what happened to a specific worker. COSHH is far more exacting about the second kind of document, because it's the one that ends up mattering decades later if someone develops an occupational illness with a long latency period.

What About the 30-Year Figure You Sometimes See?

Some sources quote 30 years instead of 40. That figure comes from a different regulatory system entirely: US OSHA's rule at 29 CFR 1910.1020, which requires US employers to keep employee exposure records for at least 30 years after the last exposure. It's a real requirement, just not a UK one, and it sits inside a separate regulatory framework with its own definition of what counts as an exposure record. Under COSHH, the 30-year figure has no direct bearing on your obligations. Some multinational businesses still adopt it voluntarily, as a single retention standard applied across sites in different countries, but that's a company policy choice, not a UK legal requirement.

What COSHH Actually Requires While a Substance Is in Use

Under Regulation 6, an employer can't carry out work involving a substance hazardous to health without a suitable and sufficient risk assessment, and that assessment has to take account of the health information the supplier provides, in practice, the SDS. HSE's own enforcement guidance confirms this is exactly what Regulation 6(2) is getting at.

What this means day to day: the current, in-date SDS needs to be genuinely accessible to anyone working with the substance, for as long as it's on site or in use. That's an ongoing availability duty, not a fixed retention period with a countdown attached. If a supplier issues an updated SDS, you replace the old one and keep using it, you don't start a fresh 40-year clock.

The Two Places a 40-Year Rule Genuinely Applies

Where COSHH does set an explicit number, it's specific and it's not about the SDS:

Health surveillance records

Under Regulation 11, where health surveillance is required for a substance, the employer must keep a health record for each affected employee "in a suitable form for at least 40 years from the date of the last entry made in it." That's the actual legal wording, and it's tied to the health record, not the SDS.

Exposure monitoring records

Regulation 10(5) splits monitoring records into two categories. Where a record represents the personal exposure of identifiable employees, it must be kept for at least 40 years. Any other monitoring record only needs to be kept for at least 5 years. The 40-year figure specifically depends on whether the record can be tied back to a named individual, not on the substance itself.

Both of these exist for the same reason: some occupational illnesses linked to hazardous substances don't show up until decades after exposure. A worker's health or monitoring record might be the only evidence available if a claim surfaces that far down the line.

So Should You Keep the SDS for 40 Years Anyway?

Not because the law says so directly, but it's still sensible, and here's the practical reasoning rather than a made-up rule. If a health surveillance or exposure monitoring record for a substance has to survive 40 years, having the SDS that generated that record on file makes that older record far easier to interpret. A monitoring record from 2026 that just references "Product X" is much less useful in 2066 without the SDS that explained what Product X actually was, its hazard classification, and its exposure limits at the time.

The HSE's own COSHH guidance treats safety data sheets, risk assessment, and record keeping as parts of the same practical package, not as separate obligations with separate clocks. Archiving superseded SDS versions alongside the records they support is the sensible reading of that, even though it's a good-practice recommendation rather than a numbered legal requirement in its own right.

What to Check When a Supplier Issues an Updated SDS

Not every revision changes your risk picture. Some updates are wording or formatting only. Before deciding whether a new SDS changes anything for your COSHH assessment, compare the new version against the old one and check these sections first, since they're the ones most likely to carry a substantive change:

• Section 2: hazard identification
• Section 8: exposure controls and personal protection
• Section 11: toxicological information
• Section 15: regulatory information

If any of these have moved, for example a revised hazard classification, a new exposure limit, or updated PPE guidance, the COSHH risk assessment built on the old SDS needs reviewing alongside it. If nothing in these sections has changed, replace the old SDS and carry on, no wider review is triggered.

After a Substance Is Discontinued

Once a substance is genuinely no longer used on site, the ongoing "readily accessible" duty under Regulation 6 falls away, there's no requirement to keep making the SDS available to a workforce that no longer handles the product. But if any employees were exposed to it while it was in use, and either a health surveillance or exposure monitoring record exists for them, keeping the corresponding SDS on file for as long as that record is retained is the sensible move, for exactly the interpretability reason above. This applies even if the substance was only used briefly or by a small number of staff, the record's retention period doesn't shrink to match how limited the exposure was.

If you're unsure whether a health surveillance record applies to a substance you've used, HSE's COSHH FAQ page is a useful starting point, and it's worth checking before deciding an SDS is safe to delete.

This Isn't the Same as a COSHH Assessment Review

It's worth separating SDS retention from a different duty that gets confused with it: reviewing your COSHH risk assessment. Regulation 6 requires the assessment itself to be kept up to date and reviewed when it's no longer valid, for example after an incident, a change in process, or new information from a supplier. That's a review trigger, not a fixed number of years, and it's a separate obligation from anything about how long a document sits in a file.

A retention question ("how long do we keep this document") and a currency question ("is this assessment still accurate") get treated as the same thing surprisingly often. They're not. An SDS or risk assessment can be perfectly well retained and still be badly out of date if nobody's checked it since a supplier reformulated the product two years ago.

Building a Simple Retention Approach

• Keep the current, in-date SDS accessible for as long as the substance is in use, replace it the moment a supplier issues an update
• Archive superseded or discontinued SDS rather than deleting them, particularly for any substance with an associated health surveillance or exposure monitoring record
• Tie SDS retention to the longest-running COSHH record for that substance, not to a fixed number attached to the SDS on its own
• Keep a note of supplier, version and revision date on archived SDS, so a document pulled out in 20 years is still traceable to what it actually covered

Common Mistakes to Avoid

• Deleting an SDS the moment a substance is discontinued, without checking whether a 40-year health or monitoring record depends on it
• Assuming SDS retention has its own fixed legal period, when the 40-year figure actually belongs to health surveillance and certain exposure monitoring records
• Assuming a 30-year figure applies here because it's what a US source quotes, when that figure comes from OSHA rather than COSHH
• Treating "must be accessible while in use" and "must be kept forever" as the same thing, they're different duties with different triggers
• Keeping health surveillance or monitoring records without the SDS that would make them interpretable decades later

You Might Also Find Useful

• An Overview of Safety Data Sheets: The 16 Sections Explained
• How to Carry Out a COSHH Risk Assessment
• What is COSHH and Who Does it Apply To in the UK?