How to choose health and safety software: what to check before you buy

Choose health and safety software by starting from the records the law expects you to keep, then checking the system can hold them for as long as the law requires, protect the health data among them, and give everything back to you if you leave. Features come after that. In Great Britain the core records are your written policy, the significant findings of your risk assessments and your health and safety arrangements, all required in writing once you employ five or more people, plus the records specific regulations require, from injury records kept for three years to health surveillance records kept for 40.

Start with the records the law expects you to keep

Software is a place to keep evidence that you have met your duties, so the first question is which records your business must hold. These are the main ones:

These are Great Britain laws; Northern Ireland has its own equivalents. Employers with 10 or more people normally employed at the same time on or about the same premises, and any employer occupying a mine, quarry or factory, must also keep an accident book under social security law, and keep each entry for at least three years.

Two records you might expect to find here are not legal requirements. HSE says you do not need to record your first-aid needs assessment, although it can be useful. And there is no general legal duty to keep training records, but HSE advises it: "Keeping training records will help you decide if refresher training is needed." For a business with fewer than five employees, the written policy, risk assessment findings and arrangements are optional; the other records in the table apply at any size wherever the regulation covers your work.

No regulation says these records have to be on paper. HSE's codes and guidance accept electronic records with conditions. COSHH health records "may be kept in any format, eg on paper or electronically", backed up so that copies can be reached "in the event of electronic failure". HSE's guidance on lifting equipment adds that a computer system holding examination information "should be protected from unauthorised alteration" and "should be able to provide a written copy when necessary". Those two conditions are worth asking any supplier about directly.

Check it can keep records for as long as the law requires

Some of these records must be kept for 40 years, which may well outlast your software contract. That creates a problem worth settling before you sign.

Data protection law requires your supplier to delete or return your data at the end of the contract, at your choice, under the rules on processors. Your retention duties do not end with the contract.

The duty to keep a COSHH health record for 40 years stays with you, so you need to be able to take everything out, in a standard format you can still open without the software, before the contract ends. If your business stops trading, regulation 11 of COSHH 2002 requires you to make the health records available to HSE.

Data protection also limits how long you keep personal data. The ICO's guidance is plain: "You must not keep personal data for longer than you need it." It also says that other legislation can set a period you must keep information for, and that where you hold health information "you must record your retention schedules". In practice, look for a system that lets you set retention by record type, with the legal minimums as the floor.

Treat the health data differently

Some of what health and safety software holds is health data. The ICO's examples of workers' health information include "the results of a worker's eye-test who has been using display screens" and records of blood tests for exposure to hazardous substances. An accident record also becomes an injury record once it details the injury suffered by an identifiable worker.

Health data is special category data under the UK GDPR and the Data Protection Act 2018, which apply across the whole UK. You need a lawful basis and a special category condition to process it; the ICO says the employment condition is particularly relevant where you are "ensuring the health, safety and welfare of workers".

The ICO also expects a high level of security for health information, and says you "could keep information about your workers' health on a separate database or system, or subject to separate access controls." The ICO says access to medical detail should be limited as far as possible to health professionals, and expects a data protection impact assessment before you start, given how sensitive the information is.

So ask how the software keeps health surveillance results and injury details apart from general compliance views, who can see them, and whether access is logged.

Questions to put to a supplier

When you use software to hold employee records, your business is the controller and the supplier is usually your processor. The ICO's guidance is that "You are ultimately accountable for your own compliance and the compliance of your processors", and that you may only use a processor you have assessed as able to protect the data properly. These are the questions that test it:

On certifications, the NCSC describes Cyber Essentials as "the minimum standard of cyber security recommended by the Government". It certifies that five technical controls are in place, and Cyber Essentials Plus adds independent testing of the same controls. The scheme's current requirements say that where an organisation's data or services are hosted on cloud services, those services "must be in scope" of its certificate, so ask whether the supplier's certificate covers the service you would be using. The NCSC's Cyber Essentials page links a search of current certificates. Treat it as a floor: the ICO describes Cyber Essentials as "only intended to provide a 'base' set of controls".

Then look at what it does day to day

Once the records and the data protection questions are settled, the features decide whether people will actually use it. Match them to the duties you are trying to evidence. Look for:

• A training matrix that flags refreshers before they lapse. Regulation 13 of the Management of Health and Safety at Work Regulations 1999 requires training when people start, when they face new or increased risks, and repeated where appropriate.
• An incident log that captures what RIDDOR requires, so it can serve as your RIDDOR record. Our guide to RIDDOR reporting covers which incidents must be recorded and for how long.
• Pre-use checks and equipment inspections, with their history in one place and the date of the next one due.
• Findings from audits and inspections turned into tasks with an owner and a deadline, and kept visible until they are closed.
• A way for contractors, agency and seasonal staff to complete inductions and checklists without full accounts.
• A system that works on a phone, and on a weak signal, if the work happens in yards, warehouses or vehicles.

Keep the volume in proportion. HSE's advice is to "Keep any documentation proportionate to the complexity of the risks concerned", and its risk assessment guidance warns: "Do not rely purely on paperwork as your main priority should be to control the risks in practice." Software holds the evidence. The managing, and the duties, stay with you. Under regulation 7 of the 1999 Regulations you still need competent help, and our guide to what health and safety requires of an employer covers the wider duties.

A checklist before you buy

1. List the records your business must keep, and how long for.
2. Confirm the software can hold each one, including the COSHH and lifting equipment records if they apply to you.
3. Check you can set retention by record type, with the legal minimums as the floor.
4. Check health data can be held separately, with its own access controls and an access log.
5. Read the data processing terms: instructions, security, sub-processors, breach notice, deletion or return, audits.
6. Find out where the data is stored and who can reach it from outside the UK.
7. Ask what security certification the supplier holds and whether its scope covers the service.
8. Test a full export, in a standard format, before you rely on it.
9. Try it with the people who will use it most, on the devices they actually carry.
10. Do your data protection impact assessment before you go live.

If you want to see how one platform handles these questions, Opus Compliance Cloud keeps health surveillance data in a separate, authorisation-protected area that is not visible in general compliance views, and lets contractors, agency and seasonal staff complete inductions and checklists through time-limited links. For the health and safety records you put in it, Opus acts as your processor under a written contract, with your organisation as the controller.

Frequently asked questions

How do I choose health and safety software? Start from the records the law expects you to keep and how long you must keep them, check the system protects the health data among them and lets you take everything out when you leave, then judge the day-to-day features.

How long do health and safety records have to be kept? It depends on the record. RIDDOR records must be kept for at least three years, COSHH examination records for five, COSHH health surveillance records for 40, and periodic thorough examination reports for lifting equipment until the next report is made or for two years, whichever is later.

Can health and safety records be kept electronically? Yes. No regulation requires paper, and HSE's codes and guidance accept electronic records, with conditions that include being readily accessible, backed up, protected from unauthorised alteration and able to produce a written copy.

Who is responsible for the data, us or the software supplier? You are. When the software holds your employee records, your business is the controller and the supplier is usually your processor; the ICO says the controller remains accountable for its own compliance and its processors'.

Is the data in health and safety software special category data? Some of it is. Health surveillance results, eye-test results for display screen users and injury details about an identifiable worker are health data, which the UK GDPR treats as special category data needing extra protection.

Does health and safety software make us compliant? No. The duties stay with you as the employer, software does not replace competent help, and HSE says your main priority should be to control the risks in practice.

Does a small business need health and safety software? Not necessarily. With fewer than five employees you do not have to write down your policy or your risk assessment findings, and HSE asks for documentation proportionate to the risks. A simple, well-kept system can be enough; software earns its place when the records, sites or people outgrow it.