Common evidence types
Common evidence includes certificates, completion confirmations, signed declarations, assessment outcomes and manager sign-off notes.
The right evidence depends on your organisation's policy and the nature of the training. Record enough context to identify the person, requirement, completion date and provider or assessor where relevant.
A certificate may prove course completion but not observed competence. For higher-risk tasks, the organisation may also need an observed assessment or other evidence defined by its process.
Avoid over-collecting
Only keep evidence that is useful, proportionate and needed for review.
Large folders of unnecessary files can make audits slower and create more data to manage.
Set retention periods by purpose, legal or regulatory need and organisational policy. The UK GDPR does not provide one universal number of years for training evidence, so be wary of generic retention claims.
Link proof to records
The most important step is linking proof to the training record it supports.
Use a review status where evidence needs checking, and record why a file was rejected or replaced. Keep the old audit trail only where there is a justified reason to do so.
SkillProof helps teams request, upload, review and report on evidence without relying on shared folders.
Official guidance used for this guide
Checked
The ICO does not prescribe one retention period for training evidence. Organisations should be able to justify what they keep, set appropriate retention periods and review or delete personal data they no longer need.