FSMA 204 record retention: how long to keep traceability records and where
Under the FDA Food Traceability Rule, you keep your traceability records for 2 years from the date you created or obtained them, unless the rule says otherwise for a specific record. You also have to be able to get them to FDA within 24 hours of a request. Both requirements come from 21 CFR 1.1455, the section on keeping and providing records.
This guide covers the retention period, the formats FDA accepts, where records may live, what “within 24 hours” means in practice and a short habit list for small teams.
How long do you have to keep FSMA 204 records?
Paragraph (d) of 21 CFR 1.1455 says to keep records for 2 years from the date you created or obtained them. The clock starts when the record exists or arrives, not when the food ships or sells.
Two practical points follow from that wording:
- Records you receive count too. A supplier’s bill of lading starts its 2 years the day you get it.
- Your traceability plan has its own rule. 21 CFR 1.1315 says to update the plan as needed and to keep the previous version for 2 years after you update it. Our traceability plan template guide explains the plan itself.
Other laws, customer contracts or your own food safety program may ask you to keep records longer. The rule sets a floor for its own records. Check with a food safety professional about anything else.
What counts as a valid record?
Paragraph (a) of the rule lets you keep records as original paper or electronic records, or as true copies such as scans or photocopies. Electronic records may include working links to required information. In every case the records must be legible and stored to prevent deterioration or loss.
That means a few common habits are fine, and a few are risky:
| Habit | Fine under the rule? |
|---|---|
| Paper bills of lading in a binder | Yes, if legible and protected from loss |
| Phone photos of case labels | Can work as true copies if they are legible and kept somewhere safe |
| Spreadsheet on a shared drive | Yes, if backed up and protected from loss |
| A link to a supplier portal | Yes, if the link works and the information is there when asked |
| Faded thermal receipts in a drawer | Risky: the rule requires protection from deterioration |
You also do not need to duplicate records you already have. Paragraph (f) says existing records that already contain the required information are enough, and you may add to them as needed.
Where can you keep records, and can you split them?
Yes. Paragraph (g) lets you split the required information across several record sets. The condition is that your traceability plan must state the format and location of each one. If receiving data is in your accounting system, lot codes are in a production log and shipping data is on paper, the plan has to say so.
Paragraph (b) also lets another entity keep records for you, such as a software vendor, a third-party warehouse or a co-packer. You are still responsible for retrieving them and providing them onsite within 24 hours of an official request.
What does “within 24 hours” mean?
Per paragraph (c)(1), you must make records available to an authorized FDA representative within 24 hours of a request, or within a reasonable time FDA has agreed to. You must also provide the information needed to understand the records.
When FDA needs records to address a foodborne illness outbreak, a recall or another threat to public health, paragraph (c)(3) applies. You must provide the requested information within 24 hours of an in-person or remote request, or within some reasonable time FDA has agreed to. If the request comes by phone, FDA will put it in writing at your request, and the 24 hours still runs from the call, so do not wait for the letter.
FDA’s rule page says that in such cases you must provide an electronic sortable spreadsheet with the relevant traceability information within 24 hours, unless you are exempt. The same page says FDA’s spreadsheet template is optional: “You are not required to use this specific electronic sortable spreadsheet template to comply with the rule.” Paragraph (c)(3) also says that certain small businesses may use other forms, so read the exact thresholds in the rule or ask FDA if that might be you. Our sortable spreadsheet guide covers building one.
Offsite storage is allowed, with a condition. Paragraph (c)(2) permits offsite storage if the records can be retrieved and provided onsite within 24 hours. Electronic records count as onsite if they are accessible from an onsite location.
So a locked storage unit across town can work if someone can fetch the box and bring it back within the day. The rule does not mention weekends, but plan for them and for holidays too. Cloud storage can work if your team can actually log in and export from the site. Think through who has the password, who is on vacation and what happens if the one person who knows the filing system is out.
If a record is in another language, paragraph (c)(4) says you must give FDA an English translation within a reasonable time on request.
Paragraph (h) says records FDA obtains under this subpart are subject to the public disclosure rules in 21 CFR part 20. If you worry about confidential business information, ask a regulatory professional how those rules apply to you.
When does this start to matter?
FDA’s rule page says the original compliance date was January 20, 2026. FDA proposed to extend the compliance date by 30 months to July 20, 2028, and Congress directed FDA not to enforce the rule before that same date. FDA says it intends to comply with the directive. Retailers and buyers may ask for traceability data sooner, so retention habits are worth setting up now.
A simple retention habit for a small team
This checklist is illustrative, not a rule. Adjust it to your operation.
- Pick one home for each record type and write it in your traceability plan.
- Scan or photograph paper records on the day they arrive, and keep the original.
- Name files by date and lot code so they sort.
- Back up electronic files, and test a restore once.
- Write the retention end date (creation or receipt date plus 2 years) on a calendar or a column in your log, and review before you discard anything.
- Name a backup person who can retrieve records within 24 hours.
- Once a year, run a drill. Our mock recall guide shows how.
Where Lotcrumb fits
Lotcrumb is being built to pull lot codes and key data elements from the invoices and bills of lading you already handle and keep them in one place, so a records request becomes an export. Join the waitlist for early access.
This guide is general information, not legal or regulatory advice. Your obligations depend on your products and operations, so confirm them with FDA guidance or a food safety professional.