Training records are the primary evidence base when an employer’s compliance with legal obligations is tested – whether in an employment tribunal, an EHRC investigation, a regulatory supervisory visit or an internal audit.

The question is not only whether records exist, but whether they contain the right information, whether they are sufficiently detailed to address the legal standards in question, and whether they are retained appropriately. This article sets out what organisations should be capturing, how, and for how long.

Why training records matter legally

Three distinct legal mechanisms make training records directly relevant to compliance outcomes:

The reasonable steps and all reasonable steps defences

Under the Worker Protection Act 2023, employers bear the burden of demonstrating they took reasonable steps to prevent sexual harassment. Under the Equality Act 2010, vicarious liability for discrimination and harassment is defeated only by showing all reasonable steps were taken to prevent the discriminatory act. In both cases, training records are the primary documentary evidence. A tribunal or the EHRC will ask who was trained, what the training covered, whether it was current at the time of the incident, and whether the manager involved had received it. Records that cannot answer all four questions weaken the defence.

PIDA detriment claims

In whistleblowing detriment cases, once a worker establishes that they made a protected disclosure and suffered detriment, the burden shifts to the employer to show the detriment was not connected to the disclosure. An employer’s ability to show its managers were trained to handle protected disclosures correctly – including knowing what a qualifying disclosure is, what detriment means, and how to avoid inadvertent retaliation – is relevant both to the substantive defence and to the credibility of the employer’s account of events.

ACAS Code uplift

Where a tribunal finds that an employer unreasonably failed to follow the ACAS Code of Practice on Disciplinary and Grievance Procedures, compensation can be increased by up to 25%. Training records showing that managers received documented training on the Code’s requirements support the argument that any procedural failure was not the product of ignorance – and potentially that the manager departed from training they had received, rather than that the employer had failed to provide it.

What records should capture for facilitated training

Facilitated training – online workshops, in-person classroom or on-site delivery – generates a record only if the organisation builds a process to capture it. At minimum, records for each facilitated training session should include:

• Course title and content summary: a description of what the course covered, at a level sufficient to demonstrate which legal obligations it addressed. A title alone is insufficient – records should note whether the content covered PIDA, the Worker Protection Act 2023, ERA 2025 amendments, the ACAS Code, or other specific frameworks
• Delivery date and format: date of delivery and whether the session was online (Microsoft Teams or equivalent), in-person classroom or on-site
• Provider and facilitator: name of the training provider and, where relevant, the facilitator. Where training is delivered by a specialist provider with sector expertise – such as investigation training led by a former police officer – the facilitator’s credentials are part of the quality evidence
• Accreditation status: whether the course is CPD Certified or carries other accreditation. This should be recorded at the time of delivery, not retrospectively reconstructed
• Attendee records: full name and role of each attendee. Records should be specific enough to allow the organisation to confirm that a particular manager received a particular course on a particular date
• Completion confirmation: for CPD Certified courses, a completion certificate for each attendee. Where post-training assessment is conducted, assessment outcomes should also be recorded
• Content version: a note of the course version or the date the content was last reviewed – particularly important where training has been updated to reflect legislative changes

What records should capture for eLearning

SCORM-compliant eLearning that integrates with an LMS generates most of the required record-keeping automatically. LMS completion reports should be configured to capture:

• Learner name and role
• Course title and version
• Completion date and time spent
• Pass/fail outcome where assessment is included
• Evidence of re-attempts and final pass status where relevant

Where eLearning is hosted on a client’s own LMS – as is possible with SCORM-compliant courses – the organisation is responsible for maintaining and backing up the LMS completion data. LMS records should be exported and archived periodically so that completion data is not lost if the LMS platform changes or the organisation moves providers.

eLearning records alone are generally insufficient for the manager-level compliance obligations imposed by the Worker Protection Act 2023 and PIDA. Facilitated training records should supplement eLearning records for managers, with the combined record demonstrating both awareness-level completion and skills-level training.

Retention periods

Employment law does not prescribe a fixed retention period for training records. Organisations should apply the following principles:

Minimum retention tied to limitation periods

Employment tribunal claims must generally be brought within three months of the act complained of (six months for equal pay claims). However, the relevant training records may be those from years before the claim is brought – courts and tribunals will consider the history of an employer’s training programme, not just what was in place immediately before the incident. A minimum retention period of six years – consistent with the standard contractual limitation period under the Limitation Act 1980 – is a practical baseline for training records.

Longer retention for regulated sectors

In financial services, healthcare and other regulated sectors, retention requirements may be set by sector regulators. FCA rules on record-keeping require regulated firms to retain records in a form that allows the FCA to monitor compliance with its rules – a standard that applies to conduct-related training records in the context of PS25/23 and SM&CR. Organisations in regulated sectors should cross-reference their training record retention policy with applicable regulatory requirements.

GDPR considerations

Training records involve personal data – names, roles, assessment outcomes. Under UK GDPR, personal data must not be retained longer than necessary for the purpose for which it was collected. Organisations should document the legitimate purpose for retaining training records (legal compliance and defence of legal claims), apply appropriate access controls, and ensure records are securely deleted when the retention period expires. Where training records relate to sensitive personal data – for example, records connected to a harassment investigation – enhanced data protection measures apply.

Organising records for rapid retrieval

Training records are most useful when they can be retrieved quickly in response to a tribunal claim, regulatory request or internal audit. Organisations should build record systems that allow retrieval by:

• Individual manager – to confirm what training a specific person has received and when
• Course or content type – to identify all managers who have received training on a particular topic
• Date range – to confirm which managers had current training at a particular point in time
• Completion status – to identify managers with outstanding or overdue training

Where training is delivered across multiple formats – facilitated courses by an external provider, eLearning on the LMS, and internal workshops – records from all formats should be held in a single consolidated system or be retrievable through a single reference index. Fragmented records held in different systems create gaps that can be difficult to close under tribunal or regulatory time pressure.

Auditing and refreshing the record

Training records are a living document of the organisation’s compliance programme, not a static archive. Organisations should conduct a periodic audit of training records – at least annually, and following any major legislative change – to identify:

• Managers with no training record in relevant subject areas
• Managers whose most recent training predates significant legislative changes – in particular, the Worker Protection Act 2023 positive duty (October 2024) and the ERA 2025 first wave (April 2026)
• Gaps in content coverage – for example, managers who have received PIDA training but not training on ERA 2025’s sexual harassment amendment
• Records that lack sufficient detail to support a reasonable steps defence

The output of the audit should feed directly into the training refresh schedule. The Safecall Benchmark Report 2024 found that discrimination reports tripled from 3% to 8% of HR cases year-on-year, and bullying increased by 5% to 17%. The volume and diversity of workplace concerns reaching HR means the training record is tested more frequently than it once was – and gaps in that record are more likely to surface in live proceedings.

Related resources

Legal Obligations for Manager Training in the UK (hub): https://www.safecall.co.uk/resource/legal-obligations-for-manager-training-in-the-uk/

How do HR teams demonstrate compliance with whistleblowing training requirements: safecall.co.uk/training/legal-obligations-manager-training-uk/hr-demonstrate-compliance-whistleblowing-training/

How does CPD-accredited training support legal defensibility: https://www.safecall.co.uk/resource/how-does-cpd-accredited-training-support-legal-defensibility/

Compliance eLearning for Employees – What to Look For: https://www.safecall.co.uk/service/whistleblower-elearning-for-all-staff/

How Safecall supports compliance record-keeping

Safecall’s CPD Certified facilitated training courses – Listen Up (Whistleblowing for Managers), Tackling Sexual Harassment – A Guide for Managers, Investigations Training and Investigative Interview Training – generate attendance records and CPD completion certificates as standard, providing the core documentation organisations need for their compliance record. SCORM-compliant eLearning courses can be hosted on clients’ own LMS for automated completion tracking. All course content is maintained to reflect current legislation, with version records available on request.

Find out more about Safecall’s training courses at safecall.co.uk/service/compliance-training/ or contact the team at learning@safecall.co.uk | +44 (0) 191 516 7720

Sources and further reading

Worker Protection (Amendment of Equality Act 2010) Act 2023: legislation.gov.uk/ukpga/2023/51

Equality Act 2010 – section 109: legislation.gov.uk/ukpga/2010/15/section/109

Public Interest Disclosure Act 1998 (as amended): legislation.gov.uk/ukpga/1998/23

Employment Rights Act 2025: legislation.gov.uk/ukpga/2025

ACAS – Code of Practice on Disciplinary and Grievance Procedures: acas.org.uk/acas-code-of-practice-for-disciplinary-and-grievance-procedures

UK GDPR and Data Protection Act 2018 – ICO guidance on retention: ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/storage-limitation/

FCA Policy Statement PS25/23: fca.org.uk/publications/policy-statements/ps25-23-diversity-inclusion-non-financial-misconduct

Safecall Benchmark Report 2024: safecall.co.uk/resources/benchmark-report/