How long do I need to keep records for?

It depends entirely on which records and who you are. There is no single retention period in Australian law, and the regimes most relevant to a hospitality business run to different clocks — from three months to seven years to permanently.

The short answer

Records	Keep for	Under
Employee records — hours, pay, leave, super	7 years	Fair Work Act and Regulations
Tax records — income, deductions, invoices	Generally 5 years	ATO
Food safety substantiation records (category one businesses)	3 months, accessible at the premises	Food Standards Code, clause 3.2.2A—12
Food handler training records	Not required at all	Clause 3.2.2A—10
Food Safety Supervisor certificate	The current 5-year issue cycle, and on the premises in NSW	Clauses 3.2.2A—11 and —2, plus state food Acts
Food business notification details	Current, and updated before any change	Standard 3.2.2, clause 4
Your own training records	Permanent, via your USI	Student Identifiers Act 2014

When periods overlap, keep to the longest that applies. Seven years is the practical floor for an employing business — but note that the food safety minimum is far shorter than people assume, and the food handler training minimum is nil.

One structural point that makes the food safety rows easier to remember. Standard 3.2.2A, which commenced 8 December 2023, imposes three tools numbered in sequence: —10 food handler training, —11 the supervisor, —12 the records. A category one business answers to all three; a category two business to —10 and —11 only. So the single clause —12 is the entire difference between the two categories, and it is the only one of the three that creates a retention period at all.

Food safety substantiation records — three months

This is the one most often got wrong, in both directions.

Standard 3.2.2A does prescribe a period. A category one business must make and keep records substantiating its compliance with specified food safety practices, and those records must be kept for three months after being made and be accessible at the premises.

Category two businesses do not carry this tool at all.

The distinction is worth getting right before you build a filing system. Category one is a caterer or food service operation that processes unpackaged potentially hazardous food into food that is both potentially hazardous and ready to eat — restaurants, cafes, pubs, fast food, bakeries, hospitals, aged care, childcare, school canteens, mobile vendors, and supermarkets or service stations that make and serve food. In practice, if you have a kitchen and you cook, you are category one. Category two is retail sale of ready-to-eat potentially hazardous food you did not make, where slicing, weighing, repacking, reheating and hot-holding do not count as making it — delicatessens, butchers, seafood retailers, some convenience stores.

What brings either category inside the standard is a prescribed activity: the handling by the business of any unpackaged potentially hazardous food that is either used in the preparation of ready-to-eat food to be served to a consumer, or is itself ready-to-eat food intended for retail sale by that business. That definition is worth writing into your own procedures, because it is the trigger for all three tools — and it is what dates the records. The first prescribed activity is the point from which the records, the trained handlers and the appointed supervisor all have to exist.

The eight things the records must cover

For a category one business, the substantiation records cover compliance with:

Receipt of potentially hazardous food at correct temperatures — 5 °C or below, or 60 °C or above
Storage of potentially hazardous food under temperature control
Process steps that achieve microbiological safety, meaning pathogen reduction
Minimising the time food spends at growth-permitting temperatures
Cooling and reheating within the specified timeframes
Display of potentially hazardous food under temperature control
Transportation of potentially hazardous food under temperature control
Cleaning and sanitising of food contact surfaces and equipment

Those eight map neatly onto the nine critical control points the Food Safety Supervisor unit SITXFSA006 is built around — receiving, storing, preparing, processing, displaying, serving, packaging, transporting, disposing. If you are designing forms, that framework is the checklist to design against.

The alternative, and its catch

A business may demonstrate compliance by other means rather than keeping records. But if an authorised officer determines that the business cannot demonstrate compliance, the officer may require records to be kept. So the practical position is that records are optional right up until the moment you need them and cannot produce an alternative — which is not a good moment to discover the gap.

One technical point that undermines a lot of record-keeping: almost every temperature record depends on a probe being accurate. SITXFSA006 specifically requires the procedure to calibrate a temperature probe. An uncalibrated probe produces records that are worse than none, because they document compliance that may not have happened. It is worth recording that the calibration itself was done, alongside the temperatures it produced.

Food handler training records — none required

Standard 3.2.2A does not require a business to keep records of food handler training, though many choose to. Nor does it mandate any refresher period for handler training, or require that the training be nationally accredited, or even that it carry a named unit code — a free, non-accredited course covering safe food handling, food contamination, cleaning and sanitising, and personal hygiene satisfies the requirement. Only the food safety supervisor needs a certificate from a registered training organisation or a recognised organisation.

What the business does carry is a continuing duty under clause 3 of Standard 3.2.2, which has applied to every Australian food business since 2000: persons undertaking or supervising food handling operations must have skills in food safety and food hygiene matters, and knowledge of those matters, commensurate with their work activities. That is a judgement about present competence, not a filing obligation — which is exactly why many businesses keep records anyway. A dated list of who was trained in what is the cheapest way to show the judgement was made, and Standard 3.2.2A did not replace clause 3 when it added the prescriptive tools on 8 December 2023.

There is one related documentation duty worth knowing. Under clause 18 of Standard 3.2.2 the business must inform all food handlers of their health and hygiene obligations — the clause 14 reporting duty, the clause 15 hand-washing requirements. That is a requirement to communicate rather than to file, but the easiest evidence that it happened is a signed induction record.

Prior learning also counts here, and the recognised routes are wider than most operators assume: competency-based training, in-house education, a food safety induction completed at another food business, or relevant previous industry experience in the food industry. Each of those is a judgement rather than a document, which is the second reason a short written note of how the judgement was reached is worth more than the standard requires.

The Food Safety Supervisor certificate — the five-year window

The FSS requirement is not a retention rule but it behaves like one. A category one or two business must have an FSS whose certificate was issued within the immediately preceding five years — a test that sits in the definitions clause 3.2.2A—2. So you need to be able to produce the certificate and establish its date of issue.

Keep the current certificate plus evidence of the preceding cycle, so a lapse or a renewal gap is documented rather than inferred.

State duties sit on top, and they differ. This is where the real deadlines live:

	Duty
New South Wales	A copy of the FSS certificate must be kept on the premises — or at the proprietor's business address for mobile catering — and produced on request under s 106G, with a maximum penalty of 25 penalty units for an individual and 50 for a corporation. NSW issues its own certificate in addition to the Statement of Attainment, from a provider approved under s 106H, which must issue it within 10 working days of successful completion; keeping only the Statement of Attainment does not satisfy s 106G. The appointment duty itself carries 50 penalty units for an individual and 100 for a corporation, with a narrow defence allowing retail sale on not more than 30 days while a replacement is appointed. One person cannot be the FSS for two premises, s 106B(1)(b)
Victoria	Council may request written details of the current FSS's name and qualifications under s 19GB, to be provided within 7 days of the written request. Maximum penalty 20 penalty units for a natural person and 100 for a body corporate; the infringement penalty is 2 and 3 penalty units respectively. But note the contrast below: no monetary penalty attaches to the supervisor requirement itself, under s 19GA
Queensland	Under s 86 the licensee must have an FSS within 30 days after the licence is issued and must at all times continue to have one, at up to 50 penalty units. Under s 88 the licensee must tell the licensing local government the name and contact details of each food safety supervisor — within 30 days of the licence being issued, and within 14 days after a person becomes an FSS, stops being an FSS, or has a change of contact details. Maximum 50 penalty units for each breach. Under s 87 the FSS must be reasonably available to be contacted by both the local government and the people who handle food, again at 50 penalty units
Western Australia	Certificate producible; `SITSS00069` is the named skill set. WA's published list of providers is a convenience listing of self-notified RTOs rather than an approval register, so a Statement of Attainment from any nationally registered RTO is valid there

The Victorian and Queensland rows turn certificate currency into a records problem as much as a training one. Seven days is not long to find a certificate issued four years ago by a provider you no longer deal with, and Queensland's fourteen-day clock starts on the day a supervisor leaves — a date nobody usually diarises.

The Victorian inversion, which is worth knowing before you set priorities

Victoria is the one state where the paperwork duty carries a penalty and the substantive duty does not. Section 19GB — the seven-day written response about the supervisor's name and qualifications — carries penalty units. Section 19GA, the requirement to have a supervisor at all, carries none. Its sanction is registration-based: failing to comply is a ground for refusal of registration or renewal, or for revocation or suspension of the registration of the premises.

That is not the lighter consequence, and it changes how a Victorian operator should read this page. The exposure for missing paperwork is a fine. The exposure for not actually having a current supervisor is the registration the business trades on. Both are worth a diary entry; only one of them can close you.

One further Victorian honesty note on the five years itself. Safe Food Victoria publishes no Victorian renewal or refresher period. Its food safety supervisor page, updated 29 June 2026, says prior training "does not usually" need repeating and confirms superseded course codes remain valid. The five-year test reaches Victoria through clause 3.2.2A—2 applied by the Food Act 1984, not through a Victorian instrument. It applies — but the source to cite if a council asks is the Code.

And if a NSW certificate has lapsed, the records question becomes a deadline: a recertification course is available only up to 90 days after expiry, only to someone who already holds or held a NSW certificate, and only from a single approved RTO that offers one. Past 90 days the full course applies. Keeping the expiry date somewhere findable is therefore worth more in NSW than anywhere else.

See Food Safety Supervisor certificate and Standard 3.2.2A explained.

Notification records — current, and updated in advance

Easy to miss because it is not a retention period at all. Under clause 4 of Standard 3.2.2 a food business must notify the appropriate enforcement agency before commencing food handling operations, giving:

contact details and the proprietor's business address
the nature of the food business
the location of all food premises within that agency's jurisdiction

And changes must be notified before they occur. Not afterwards. So the records that matter here are the ones showing what you told the agency and when, because the obligation is anticipatory rather than retrospective.

In Victoria this sits alongside registration: Class 1, 2, 3 and 3A premises register with the local council, and Class 4 premises notify instead. Councils classify on the highest-risk activity undertaken at the premises, under s 19C, so a change of menu can be a change of class — which is one of the changes clause 4 requires you to notify in advance.

Employee records — seven years

If you employ people, this is the obligation with the sharpest teeth. Employers must make and keep records covering hours worked, pay, overtime and penalties, leave, superannuation contributions, and the terms of employment — for seven years.

The records must be legible, in English, and not altered except to correct an error. Failing to keep them, or keeping false records, is a contravention in its own right, independent of whether anyone was underpaid.

That last point is what businesses miss. In an underpayment dispute the absence of records does not work in the employer's favour — it makes the claim harder to defend.

Payslips are separate: they must be issued within one working day of pay day, and keeping copies is part of the seven-year duty. Note also that award coverage is decided by the premises, not the job title, so the classification recorded against an employee has to match the award that actually applies to the venue. See superannuation, tax and payslips and working hours, rosters and public holidays.

Tax records — generally five years

The ATO's general rule is five years from when you lodge, covering income, expenses, invoices and asset records. Some situations run longer, particularly where an asset is involved.

Seven years for employee records already covers most of this, which is why seven is the sensible operating standard for a venue.

Your own training records — permanent

As an individual, you do not need to keep your certificates safe in the way you might think. Every nationally recognised qualification and Statement of Attainment issued to you since 2015 is linked to your Unique Student Identifier and retrievable from your USI transcript for life.

Keep your certificate and ask the issuing RTO for a replacement if needed. A USI transcript can help verify reported training, but it is not a guarantee that every credential will appear. For nationally recognised training, a Unique Student Identifier (USI) is generally required before a qualification or Statement of Attainment can be issued, unless an applicable exemption applies. See the official USI exemption guidance. A USI is free at usi.gov.au. If you already have one, recover it rather than creating another. The Act also limits who may collect or use your USI.

One thing to check on an older certificate: the name of the issuing body. We appear on the national register under six trading names, five current. The sixth, Complete Healthcare Training, ran from 24 October 2023 to 19 April 2025, so a certificate issued in that name is an RTO 3722 credential even though the name is no longer in use. An employer searching the current name will not find it, and that is the explanation.

One Victorian bonus worth knowing: a lost RSA certificate is replaced free by completing the RSA Refresher — see can I renew my RSA online in Victoria.

Who holds what

It helps to separate the three parties, because the duties do not sit in the same place.

	What they hold	For how long
The individual	Statements of Attainment, qualifications — mirrored on the USI transcript	Permanent, via USI
The business	Employee records; food safety substantiation records if category one; the FSS certificate; notification details; food handler evidence if it chooses to keep it	7 years / 3 months / current 5-year cycle / current / optional
The RTO	Certification records for what it issued, enabling reissue	Per the VET regulatory requirements

The common confusion is an individual assuming the business keeps their credential, or a business assuming the RTO keeps its compliance evidence. Neither is true.

A workable rule for a venue

Seven years for anything employment-related. It satisfies Fair Work and covers tax.
Three months minimum for category one food safety substantiation records — but if you are running a food safety program, keep them for its cycle rather than to the floor.
Current certificates on the premises, always — mandatory in NSW, and the answer to a Victorian seven-day request.
Diarise supervisor dates, both the five-year issue date and the day a supervisor leaves, because Queensland's notification clock starts there and NSW's 30-day replacement window does too.
Calibrate the probe, and record that you did. Temperature records rest on it.
Digital and backed up. Records must be legible and produceable; a water-damaged box in a cellar is not. Food safety substantiation records must be accessible at the premises, so a system needing head-office access is a risk.
Keep the notification trail, including what you told the agency before you opened and before each change.
Write down the clause 3 judgement even though nobody asks for it. It is the only duty on this page with no prescribed record and no expiry, which makes it the easiest to fail to evidence.
Do not rely on "other means" for food safety compliance unless you know exactly what you would show an officer.

About us

We are Complete Hospitality Training, RTO 3722, CRICOS 04242E. Level 3, 28 Elizabeth Street, Melbourne VIC 3000, and 410 Elizabeth Street, Surry Hills NSW 2010. Contact melbourne@cht.edu.au or +61 3 9654 1554.

Registered since 1 June 1994; current registration, exercised by ASQA, runs to 30 June 2032. SITSS00068 Food Handling and SITSS00069 Food Safety Supervision are both on scope at the extent "Deliver and assess", and have been since 10 June 2022.

We link to the relevant course and regulatory sources in this guide. Check those sources for current requirements, and confirm course availability, delivery, fees and entry requirements with us before enrolling.

How long must food safety records be kept?

Three months after being made, for a category one business, and they must be accessible at the premises. Category two businesses have no substantiation records duty.

Does Standard 3.2.2A really set a period?

Yes — three months, under clause 3.2.2A—12. It is a common misconception that the standard only requires you to "be able to substantiate" compliance with no fixed period.

Which clause creates which duty?

Clause 3.2.2A—10 is food handler training, —11 the supervisor appointment, and —12 the substantiation records. Category one answers to all three; category two to —10 and —11. The five-year currency test for the supervisor sits in the definitions clause —2.

Do I have to keep records of food handler training?

No. Standard 3.2.2A does not require it. Many businesses do anyway, because it is the simplest way to show handlers were trained before starting a prescribed activity, and the simplest evidence of the clause 3 judgement.

What is clause 3 and why does it affect my records?

Clause 3 of Standard 3.2.2 has required, since 2000, that people undertaking or supervising food handling have skills and knowledge commensurate with their work activities. It sets no records duty, but if you cannot show who knows what, you cannot easily show you complied.

What counts as a prescribed activity?

The handling by the business of any unpackaged potentially hazardous food that is either used in preparing ready-to-eat food to be served to a consumer, or is itself ready-to-eat food intended for retail sale by that business. It is the trigger for all three tools, and the date the clock starts.

Do I have to keep records for casual staff?

Yes. The seven-year employee record obligation covers all employees.

What if an employee leaves?

The seven years runs regardless. Do not discard records when someone resigns. If the person leaving was the food safety supervisor, Queensland gives you 14 days to notify the local government, and in NSW there is a statutory defence covering not more than 30 days of trading while you appoint a replacement.

Can I keep them digitally?

Yes, provided they are legible, in English and accessible on request. Food safety substantiation records must be accessible at the premises.

Can I skip records if I can show compliance another way?

Standard 3.2.2A allows it — but if an authorised officer decides you cannot demonstrate compliance, they may require records to be kept. The alternative is only as good as what you can actually produce on the day.

How quickly do I have to produce the supervisor's details in Victoria?

Seven days from a written council request, under s 19GB of the Food Act 1984 (Vic), and the details themselves must be in writing.

Is the penalty in Victoria on the paperwork or on the supervisor?

On the paperwork, which is the counter-intuitive part. Section 19GB carries penalty units for failing to respond within seven days. Section 19GA, the duty to have a supervisor at all, carries no monetary penalty — its sanction is refusal, revocation or suspension of the premises' registration. That is the larger exposure, not the smaller one.

What are the Queensland notification deadlines?

Under s 88, within 30 days of the licence being issued, and within 14 days of a person becoming or ceasing to be the FSS or changing contact details. Fifty penalty units maximum per breach. Separately, s 86 requires the supervisor to be in place within 30 days of the licence issuing and to continue at all times.

I lost my own certificate.

Your USI transcript has the record. The RTO can reissue.

How long do I keep RSA and food safety certificates?

At least the current currency cycle — three years for Victorian RSA currency, five years for an FSS certificate — plus evidence of the preceding one.

Does my FSS certificate have to be on the premises?

In New South Wales, yes, under s 106G, or at the proprietor's business address for mobile catering. Elsewhere it must be producible on request, which in practice means the same thing.

We are a deli. Do the three-month records apply to us?

Probably not — a deli that receives ready-to-eat food unpackaged and only slices, weighs, repacks, reheats or hot-holds is category two, which does not carry the substantiation tool. You still need trained handlers and a supervisor.

Our charity runs a fundraising stall. What do we keep?

Standard 3.2.2A does not apply at a qualifying fundraising event — one raising funds solely for a community or charitable cause and not for personal financial gain. The narrower clause 2 exemption from Standard 3.2.2 only applies where the food is not potentially hazardous or is eaten immediately after thorough cooking, so clause 3 can still bite. State law may also apply on a different trigger: in Queensland a non-profit selling prepared meals on at least 12 days a financial year is a licensable food business and needs an FSS.

What do I need to record before opening?

What you notified to the enforcement agency under clause 4 of Standard 3.2.2 — contact details and the proprietor's business address, the nature of the business, and the location of every premises — and the date. Changes must be notified before they happen.