What Records to Keep for Employee Compliance Training, and for How Long
Short answer: for every person and every requirement, keep who completed it, what exactly they completed (the version or the certificate), and the date and time. Keep it for the longest period any rule that applies to you sets, which ranges from one year to six, and keep it after the person leaves: many periods run from the training date, and claims can arrive long after someone's last day.
What a training record should show
- Who: the employee's name and email or employee number.
- What: the course or policy title, and which version. If you revised the policy in March, the record must show whether someone signed the January or the March version.
- When: a system-generated date and time of completion, not a date typed in later.
- The proof itself: the certificate for a course, or the signed acknowledgment for a policy, with the statement the person agreed to.
- The result, where it matters: a quiz score or pass/fail, if the course reports one.
- Exceptions: anyone you excused, and why, such as training completed elsewhere that you verified.
Also keep a copy of the course or policy itself as it was on that date. If someone challenges what they were taught, the record of completion only helps if you can show the material.
How long to keep training records
These are the periods set by rules we have checked. Where a rule requires a record but sets no period, the table says so.
United States
Personnel and employment records (employers covered by Title VII, the ADA or GINA)
At least 1 year; all relevant records once a discrimination charge is filed, until it is resolved
29 CFR 1602.14
California
Harassment prevention training (5+ workers)
At least 2 years, including certificates
2 CCR §11024
New York City
Harassment prevention training (15+ employees)
At least 3 years, such as signed acknowledgments
NYC Admin. Code §8-107(30)
Illinois
Harassment prevention training
A record of all trainings, available for IDHR's review. No period stated
775 ILCS 5/2-109; IDHR
Connecticut
Harassment prevention training
No record prescribed. The CHRO certificate is the proof
CHRO FAQ
US, OSHA
Bloodborne pathogens training
3 years from the training date
29 CFR 1910.1030(h)(2)(ii)
US, OSHA
Forklift operator certification
A current written certification for each operator. No period stated
29 CFR 1910.178(l)(6)
US, HIPAA
Policies, procedures and required documentation, including training
6 years from creation or the date last in effect, whichever is later
45 CFR 164.530(j)(2)
Ontario
Health and safety awareness training
A record you must maintain, and written proof on request for up to 6 months after the person leaves
O. Reg. 297/13, s. 4
Ontario
AODA accessibility training
50+ employees in Ontario and public sector: a record with dates and number trained. No period stated
O. Reg. 191/11, s. 7(5)
Ontario
Violence and harassment information and instruction
No record prescribed; the Code of Practice says keep documentation at least 1 year
OHSA; Code of Practice
General information, not legal advice. Checked against the sources on October 3, 2026. Other rules, such as those for your industry or a union agreement, may set longer periods.
A practical rule
Most small employers don't track a different period for each rule. A simpler policy: keep every training and sign-off record for at least as long as the longest period in the table that applies to you, counted from when the person leaves, and never delete records just because someone left. Ask your lawyer whether a longer period suits your business.
Why spreadsheets make weak records
A spreadsheet with "Done" next to a name can't show when "Done" was typed, which version the person saw, or where the certificate is. When the record and the proof live in different places, producing them under pressure means searching email. A system that timestamps the completion and stores the proof with it answers all three questions at once.
What Ethica keeps
For each assignment, the record holds:
- the employee, the requirement, when it was assigned and when it was due,
- the date and time it was completed,
- for a policy: the version, effective date, file name and a checksum of the exact file, the statement agreed to, the IP address and browser, and a copy of the signed policy,
- for a course hosted elsewhere: the uploaded certificate, the date earned and who recorded it,
- for a course file: the score, result and time the course reports, when it sends them, and a certificate of completion, and
- exemptions, with the reason you gave.
Records stay when you deactivate an employee or archive a requirement. Export them as a spreadsheet, or as a zip of certificates, signed acknowledgments and signed policy files. Watch how to export training records.
Read next: how to prepare for a compliance training audit, or what an Ontario Ministry of Labour inspector asks for.