How Long to Keep Food Safety Records in NZ

How long must food safety records be kept in NZ?

At least 4 years, counted from the date each record was created. The duty sits with the operator of the food business, and the same 4-year period applies whether you run a registered Food Control Plan (regulation 36) or operate under a National Programme (regulation 81). Here is the exact wording of regulation 36(1) of the Food Regulations 2015:

“The operator must keep each record for a period of at least 4 years after the date on which the record is created.”

— Regulation 36(1), Food Regulations 2015. Regulation 81(1), which covers National Programme businesses, uses identical wording.

Two details worth noticing. First, the clock runs per record: a fridge-temperature entry made today must still exist 4 years from today, regardless of what else you keep. Second, 4 years is a minimum — nothing stops you keeping records longer.

What counts as a “food safety record”?

The regulations define records by their purpose, not by a fixed list: anything you keep that lets you — or the people who check on you — confirm you are meeting your obligations under the Food Act. Regulation 35(1) of the Food Regulations 2015 puts it like this:

“The operator must ensure that records are kept that enable any 1 or more of the following persons to ascertain whether the operator is meeting the operator’s obligations under the applicable requirements of the Act: (a) the operator: (b) the chief executive: (c) the registration authority that the food control plan is registered with: (d) a food safety officer: (e) the operator’s verification agency or verifier.”

— Regulation 35(1), Food Regulations 2015

In practice, for a Simply Safe & Suitable template business that means things like daily fridge and chiller temperature checks, trusted supplier deliveries, staff training and sickness records, equipment maintenance, and what-went-wrong corrective actions — MPI’s Record keeping guidance (February 2026) maps the full mandatory and optional list. Every one of those records, once created, is inside the 4-year rule.

The quality bar: what a record must look like for those 4 years

Keeping a record is not just storing it — the regulations set a quality standard that applies for the whole retention period. Under regulation 37 (mirrored by regulation 82 for National Programme businesses), each record must be “legible, accurate, and complete”, be “dated or marked in a way that identifies the version”, and be readily accessible to the people listed above. And for any record of an activity — a temperature check, a delivery, a clean-up after something went wrong — regulation 37(2) requires that it:

“(a) states the date and, if appropriate, the time at which the activity was performed; and (b) describes the results of the activity; and (c) names or otherwise identifies the person or persons who performed the activity.”

— Regulation 37(2), Food Regulations 2015

MPI’s February 2026 Record keeping guidance compresses the same idea into plain English: all records must “be accurate; be easy to read; identify what was done; say when it was done; say who did it”, be “available when requested by verifier and MPI”, and “be kept for 4 years”. Who, when, result, dated — on every entry, for 4 years.

What 4 years of records looks like in practice

Paper record-keeping is completely legal and MPI actively supports it — the current Simply Safe & Suitable record blanks are an official MPI resource, refreshed on 27 February 2026 in PDF, Word and Excel. The question is not legality; it is how much work each method takes over a 4-year horizon.

KitchenSorted’s free plan captures every entry with the date, time, result and who did it. 4 years of history, verification packs and reminders live in the paid plan; your free-plan records are never deleted and unlock when you upgrade.

Kept is not the same as available

The retention rule has a quieter second half: records must be readily accessible when your verifier, MPI or a food safety officer asks (regulation 37(1), and MPI’s guidance repeats it — records “need to be available when requested by verifier and MPI”). A shoebox of faded thermal-paper delivery dockets technically still exists, but if nobody can find June’s fridge log or read last winter’s goods-in temperatures, the accessibility bar is doing the failing — not your diligence.

This is where most of the real-world pain lives. At a verification visit, the verifier reviews the records your plan or programme requires — and time spent hunting through folders is time on the clock. A verification pack that assembles the requested period into one dated PDF turns that hunt into a handover.

Record retention FAQs

When does the 4-year clock start?

On the date each individual record is created — the regulations say “at least 4 years after the date on which the record is created”. It is a rolling, per-record period, not a calendar-year rule: today’s temperature log expires from the retention window 4 years from today.

Do I need to keep records if I closed or sold the business?

The regulations place the record-keeping duty on “the operator”, and the retention wording doesn’t spell out closure or sale scenarios, so we won’t guess at one. Before destroying anything, ask MPI or the registration authority your plan or programme was registered with — they can tell you what applies to your situation.

Does the app plan I’m on change my legal duty?

No. The 4-year retention duty is yours as the operator, and paper records or exports satisfy it — no software plan is legally required. In KitchenSorted, 4 years of history, verification packs and reminders live in the paid plan; your free-plan records are never deleted and unlock when you upgrade. See how the plans differ.

Is the 4-year period the same for National Programme businesses?

Yes. Regulation 81(1) applies the identical wording to National Programme businesses that regulation 36(1) applies to Food Control Plan businesses: each record kept for at least 4 years after the date it was created. Regulation 82 also mirrors the regulation 37 quality and accessibility requirements.