Recordkeeping (29 CFR Part 1904, all covered employers)

Retention and Updating of Records

Verified vs OSHA sources · 2026-10-05

29 CFR 1904.33

29 CFR 1904.33 sets how long injury records must be kept and updated. Employers must retain the OSHA 300 Log, the privacy case list, the 300-A annual summary, and the 301 Incident Reports for five years after the end of the calendar year the records cover, and must update the stored 300 Log (though not the 300-A or 301) if they later learn of a new recordable case or a change to a recorded one.

29 CFR 1904.33 at a glance

Retention period: Five years after the end of the covered calendar year
What to keep: 300 Log, privacy case list, 300-A summary, and 301 Incident Reports
Update duty: Update the stored 300 Log for newly found or changed cases
No update needed: The 300-A and 301 need not be updated (only the 300 Log)
Transfer of business: A successor must keep the prior owner's records
Max penalty (2026): Other-than-serious $16,550; willful $165,514

What 29 CFR 1904.33 requires (plain English)

29 CFR 1904.33 governs retention and updating of the recordkeeping forms. Employers must save the OSHA 300 Log, the privacy case list (if one exists), the 300-A annual summary, and the 301 Incident Report forms for five years following the end of the calendar year that the records cover. During that window the records must be available for inspection and for employee and representative access.

The rule also imposes an updating duty, but only on the 300 Log. If, during the five-year retention period, the employer learns of a recordable injury or illness that was not recorded, or of a change (for example, a case that turns out to be more serious, or a classification that changes), the employer must update the stored 300 Log to reflect it. The 300-A summary and the 301 Incident Reports do not have to be updated.

Retention follows the business, not just the calendar. Under the related transfer provisions, if an operation changes ownership, the new owner must retain the records for the remainder of the five-year period, so the injury history is not lost when a business is sold. Keeping the records intact and current is what makes multi-year trend analysis and after-the-fact access possible.

The regulatory text

“You must save the OSHA 300 Log, the privacy case list (if one exists), the annual summary, and the OSHA 301 Incident Report forms for five (5) years following the end of the calendar year that these records cover.”

29 CFR 1904.33(a)

Key facts about 29 CFR 1904.33

Keep the 300 Log, privacy case list, 300-A, and 301 forms for five years (1904.33(a)).
The five years run from the end of the calendar year the records cover.
The stored 300 Log must be updated for newly discovered or changed cases.
The 300-A and 301 forms do not have to be updated once the year closes.
Records must be available for employee and representative access during retention.
A successor employer must keep the prior owner's records for the remaining period.
Discarding records inside the five-year window is a recordkeeping violation.

Scope: who 29 CFR 1904.33 applies to

Regulatory framework: Recordkeeping (29 CFR Part 1904, all covered employers)
Citation reference: 29 CFR 1904.33
Enforcement status: In force and enforced
Jurisdiction: Federal OSHA (29 State-Plan jurisdictions may be stricter)

State-Plan states (e.g. California, Washington, Michigan) operate OSHA-approved programs that must be at least as effective as federal OSHA and frequently impose higher penalties or additional requirements. Confirm the rule as adopted in your state.

Key requirements of 29 CFR 1904.33

#	Employer obligation
1	Retain OSHA 300, 300A, and 301 forms for 5 years
2	Update stored 300 Log within the 5-year period
3	Do not update 300A Summary after posting
4	Transfer records if establishment changes ownership

Summarized from the text of 29 CFR 1904.33. Always read the full regulation for the binding language.

Common Record Retention violations

Deficiencies OSHA cites under 29 CFR 1904.33 include the ones below, in no particular order. Distinct deficiencies can be cited as separate items, and each serious item carries up to $16,550 (2026). Broader per-instance stacking exists but is a discretionary, case-by-case OSHA enforcement policy, not an automatic multiplier.

Discarding 300 Logs, 300-A summaries, or 301 reports within the five-year window (1904.33(a)).
Not updating the stored 300 Log for a newly discovered recordable case (1904.33(b)(1)).
A successor employer failing to keep the prior owner's records (1904.34).
Records not available for employee or representative access (1904.35).
No privacy case list retained alongside the Log (1904.33(a)/1904.29(b)(9)).

Only the stored 300 Log must be updated, but all four records must be kept for five years

Two points trip employers up. First, the retention period is FIVE years beyond the year the records cover, so at any time you should have the current year plus roughly the prior five available, not just last year's. Purging older Logs to "clean up" is a violation. Second, the updating duty is narrow: if you discover a case late or a recorded case changes, you must update the stored 300 LOG, but you do NOT have to go back and revise the 300-A summary or the 301 Incident Reports. Many employers either discard too early or, conversely, think they must re-issue every form; the rule is keep all four for five years, update only the Log.

What OSHA inspectors look for

A compliance officer asks for the current year plus the prior five years of 300 Logs, 300-A summaries, and 301 reports, and checks whether the retained Logs were updated for newly discovered or changed cases. Discarded records inside the five-year window are the classic finding.

Example: how a violation is cited

During an inspection OSHA asks for the last five years of 300 Logs; the employer purged everything older than the prior year. OSHA cites 1904.33 for failing to retain the records for the required five years, up to $16,550.

Illustrative example, not a specific OSHA case.

Record Retention compliance checklist

Use this to evaluate your compliance with 29 CFR 1904.33. Each item is a key requirement OSHA may verify during an inspection.

Retain the 300 Log, privacy list, 300-A, and 301 forms for five years past each covered year.
Keep the current year plus the prior five years accessible for inspection.
Update the stored 300 Log when you learn of a new or changed recordable case.
Do not alter the 300-A or 301 after the year closes (only the Log is updated).
On a change of ownership, transfer the records so the successor can retain them.
Make records available for employee and authorized-representative access.

2026 penalties for 29 CFR 1904.33

Maximums set by 29 CFR 1903.15(d). 2026 amounts unchanged from 2025 (no CPI adjustment; OMB M-26-11). Not an increase. The 2025 OSHA penalty levels remain in effect for 2026; OSHA made no inflation adjustment for 2026. 29 CFR 1903.15 identifies January 15, 2025 as the effective reference for these amounts, while OSHA's public penalties page currently references penalties assessed after Jan. 15, 2026.

Violation type	Minimum	Maximum	When it applies
Serious	$1,085	$16,550	Substantial probability of death or serious physical harm.
Other-Than-Serious	$0	$16,550	Relates to safety/health but unlikely to cause death or serious harm.
Willful	$11,823	$165,514	Intentional, knowing, or voluntary disregard of the requirement.
Repeated	$4,256	$165,514	A substantially similar violation cited within the last 5 years.
Failure to Abate	None	$16,550/day	up to $16,550 per day; total capped at 30x the daily amount (FOM Ch.6)

Failing to retain or update records within the five-year window is cited as other-than-serious, up to $16,550; willful destruction can reach $165,514 and, if deliberate falsification, criminal exposure.

Maximums and the willful minimum are set by 29 CFR 1903.15(d); the serious and repeated minimums are OSHA policy floors from its annual penalty adjustment memo. OSHA applies gravity-based and size, good-faith and history reductions (FOM CPL 02-00-164 Ch.6). Estimates only, not legal advice.

The business case for Record Retention compliance

Injury records are only useful if they survive long enough to show trends and be available when OSHA, employees, or successors need them. The five-year retention window preserves the data across business cycles, and the duty to update the stored 300 Log means a case discovered late, a diagnosis that arrives months later, still gets captured. Discarding records early erases the history the whole system depends on.

Free compliance tools for 29 CFR 1904.33

Record Retention Calculator Records Retention Schedule OSHA 300A Auto-Filler

Record Retention penalties by state

Penalties and enforcement vary by state. State-Plan states may impose higher penalties and additional requirements beyond federal 29 CFR 1904.33.

Alabama Arkansas Colorado Connecticut Delaware District of Columbia

View all 50 states + DC →

Frequently asked questions about 29 CFR 1904.33

How long must OSHA 300 Logs be kept?

Under 1904.33, you must keep the OSHA 300 Log, the privacy case list, the 300-A annual summary, and the 301 Incident Reports for five years following the end of the calendar year the records cover. In practice that means the current year plus the previous five years should be retained and available for inspection.

Do I have to update old OSHA 300 Logs?

Yes, but only the 300 Log. During the five-year retention period, if you learn of a recordable case you missed or a recorded case changes (for example, it becomes more serious), you must update the stored 300 Log. You do not have to update the 300-A annual summary or the 301 Incident Reports: those stay as originally completed.

What happens to injury records when a business is sold?

They must be preserved. The successor employer must retain the records the prior owner was required to keep for the remainder of the five-year retention period. Selling or transferring the operation does not erase the retention obligation; the injury history follows the business.

Can employees see the injury records?

Yes. During the retention period, employees, former employees, and their representatives have a right of access to the 300 Log and related records under §1904.35 (with names withheld on privacy-concern cases). This access right is one reason the records must be retained and available, not just filed away.

Regulatory history of 29 CFR 1904.33

The five-year retention period and the duty to update only the stored 300 Log took effect January 1, 2002 (66 FR 5916). The design deliberately keeps the summary (300-A) and per-incident reports (301) fixed once the year closes while requiring the running Log to be corrected as later information arrives: balancing a stable record with an accurate one.

Related glossary terms

Key terms that appear in 29 CFR 1904.33, each with a full plain-English explainer.

Recordable Injury Industrial Hygiene National Emphasis Program Job Hazard Analysis

Related guides & articles

OSHA Forms 300, 300A & 301 Recordkeeping Guide OSHA Recordkeeping: When Is an Injury Recordable?

Related OSHA standards

29 CFR 1910.1020

Exposure & Medical Records

29 CFR 1904.4

Recording Criteria

29 CFR 1904.5

Work-Relatedness

29 CFR 1904.7

General Recording Criteria

Primary sources

OSHA figures on this page are imported from HazComFast's verified regulatory module (verified 2026-10-05 against eCFR, OSHA.gov, and the Federal Register).

This page is an educational summary, not legal advice. OSHA standards and penalty amounts change; confirm requirements against the current regulation and your applicable State-Plan before acting.

Get the Binder in Order Before the Inspector Arrives. Are You Ready?

OSHA does not give advance notice of inspections (29 CFR 1903.6). Get the binder in order before the opening conference, not during it.

Serious Violation

$16,550

per violation (max)

HazComFast Pro

$199/mo

10 jobsites, unlimited chemicals, unlimited workers

Use the free tools View Pricing

New sign-ups are paused. The free tools below need no account, and customers can log in as usual.

Your account keeps working as usual. Cancel anytime.