SFCR Record Retention: What "Two Years of Records" Actually Means for Your Operation

If you operate a licensed food business in Canada, you have probably heard that the Safe Food for Canadians Regulations require you to keep records for "two years." That number sounds simple. In practice, the two-year rule raises more questions than it answers, and the answers matter, because your records are the primary evidence that your preventive controls actually worked.

This article is for SFCR-licensed operators who want a practical understanding of what the retention requirement covers, what "two years" means in real terms, and where most operations lose records before they ever need them.

It will give you a clearer picture of where your current record-keeping might be exposed, and what to do about it.

Note: This article is a practical overview, not legal advice. Record retention obligations under the SFCR vary by commodity, activity, and licence type, and some records have different retention periods. Consult the Canadian Food Inspection Agency or a qualified food safety professional for guidance specific to your operation.

The two-year baseline, and where it comes from

The SFCR generally requires that records related to your Preventive Control Plan be retained for a minimum of two years from the date the record was made. That includes most monitoring records, corrective action records, verification records, and the documents that support traceability and complaint handling.

There are exceptions. Records for shelf-stable low-acid foods packaged in hermetically sealed containers are generally required to be kept for three years. Other commodity-specific rules under the SFCR or related regulations may extend the period further. If your operation handles a regulated commodity with its own retention rules, those apply in addition to the SFCR baseline.

The CFIA publishes the relevant requirements on its record keeping guidance pages, and it is worth reading them with your specific products and activities in mind rather than relying on the general two-year figure.

What "two years" actually counts from

The most common misunderstanding about retention is when the clock starts, and the answer depends on the type of record.

For PCP-related monitoring, corrective action, and verification records, the period generally runs from the date the record was created or from the last activity related to the record. A monitoring record dated June 1, 2024 should be retained until at least June 1, 2026, which is two years from creation, not two years from the last day of the calendar year.

Traceability records are generally retained for two years from the date the record was made.

Complaint and recall records are typically retained for two years from the date the complaint was received or the recall action was closed out.

For shelf-stable products with long shelf life, retention may need to align with the product's shelf life rather than the two-year minimum. A recall investigation can reach back to a specific lot, and many operations choose to retain records for at least two years past the end of the product's shelf life so the record is still available when it might be asked for.

The regulatory minimum and the practical minimum are not always the same number.

The types of records that need to be retained

The SFCR record-keeping requirements cover more than temperature logs. A defensible record-keeping system generally addresses the full range of activities described in your PCP.

Monitoring records. These are the routine readings and observations at each critical control point. Temperature logs, humidity logs, sanitation checks, metal detector verification, allergen swabs, and any other measurement your PCP says you take. Each entry should identify what was measured, when, by whom, and the result.

Corrective action records. When monitoring shows a control failed, the response needs to be documented. That includes what was observed, what was done with affected product, how the root cause was investigated, and what steps were taken to prevent it from happening again. Many operations capture the deviation but stop short of recording the rest.

Verification records. Verification is the periodic check that your controls are working as intended. Records typically include thermometer and sensor calibration, internal audits, record reviews, and product testing where relevant. The SFCR generally expects both monitoring and verification, and both fall under the retention requirement.

Traceability records. Where SFCR traceability requirements apply, operators are generally required to track product one step back to their immediate supplier and one step forward to their immediate customer. That includes lot codes, incoming raw material records, production records, and shipping records sufficient to identify where a specific lot came from and where it went. Retail operations have a more limited obligation, generally one step back to the immediate supplier.

Complaint and recall records. Consumer complaints, investigation notes, recall communications, and the supporting documents that informed those decisions are part of the record-keeping picture, and they often need to be available quickly during an investigation.

There are more categories depending on your licence and commodity, but these five cover the bulk of what most food businesses are expected to retain.

Paper or electronic: what the CFIA accepts

The SFCR is generally neutral on whether records are paper or electronic. Either format can be acceptable, provided the records are accurate, legible, and retrievable when an inspector asks for them.

For electronic records, practical controls may include: validated systems that detect invalid or altered entries, the ability to produce readable copies on request, secure access controls, an audit trail of changes, reliable backups, and protection for timely retrieval. A system that quietly overwrites old data or that depends on a single hard drive without backup creates risk. The CFIA's record keeping guidance outlines these expectations in more detail.

Paper records do not require any technology, but they require physical care: a place where they will not be lost, damaged, or thrown out by accident, and a filing approach that makes it possible to retrieve a specific record from two years ago without a treasure hunt.

The right format depends on the operation. The wrong choice is the one that lets records disappear quietly between audits.

Where retention typically fails

Most operations do not lose records on purpose. They lose them because something happened that the system was not designed to handle. The same patterns show up repeatedly.

Lost paper logs. Binders move between offices, get stored in damp areas, or end up on the wrong shelf during a cleanup. A missing month of cooler logs from eighteen months ago is hard to recreate.

Employee turnover. A supervisor leaves and takes their personal knowledge of where things were stored with them. The replacement inherits a filing system they did not build and cannot fully reconstruct.

Hardware failures. A laptop with a year of spreadsheets dies, or a desktop in the office is replaced and the old drive is wiped without anyone confirming the records were copied. Cloud syncing helps, but only if it was set up correctly in the first place.

Subscription gaps. Sensor data lives in a vendor's cloud platform, the subscription lapses, and the historical data is no longer accessible. If your records depend on a third-party service, you need to know how long they retain data after a cancellation and how to export the archive while it is still available.

Records that were never created. Overnight, weekend, or holiday gaps in manual logs cannot be retained, because they were never written down in the first place. Two years of complete records starts with a system capable of producing complete records every day.

A practical retention setup

For most operations, a workable retention practice combines a few habits.

Decide where each type of record lives, and write it into the PCP. Inspectors generally expect the plan to describe the record-keeping system, not just the monitoring.

Back up electronic records to a second location that you do not depend on day to day. If you store data with a vendor, export a copy to your own storage at least quarterly so you are not dependent on the subscription staying current.

Calendar an annual record review. Pick a date, walk through the last twelve months of records by category, and confirm everything is present, legible, and where it should be. If you find a gap, it is much easier to investigate close to the event than two years later.

Hold records longer than the minimum where it makes sense for your products. Two years is the floor, not a ceiling, and the extra storage is generally cheaper than the alternative.

Treat the retention plan as part of the PCP itself. When equipment, software, or staff change, update the plan and confirm that the change has not orphaned a category of records.

Record retention is not the most visible part of food safety, but it is one of the places where a strong operation is easiest to tell apart from a weak one. Good records help an inspector confirm the operation is doing what its PCP says it does, which tends to shorten and simplify an inspection.

Storage Sentry is a wireless monitoring platform purpose-built for Canadian agricultural operations. It generates continuous, timestamped temperature and humidity records and keeps them exportable, helping support the monitoring and record retention portions of your Preventive Control Plan. Learn how Storage Sentry can help.

References

Canadian Food Inspection Agency. "Preventive control plan for food businesses: Record keeping." inspection.canada.ca
Canadian Food Inspection Agency. "Regulatory requirements: Preventive control plan for food businesses." inspection.canada.ca
Canadian Food Inspection Agency. "Understanding the Safe Food for Canadians Regulations: A handbook for food businesses." inspection.canada.ca
Canadian Food Inspection Agency. "Traceability for food: A handbook for food businesses." inspection.canada.ca