Regulatory audits aren't just about current complianceโthey reach backward. The CAA, CASA, or EASA inspector arrives and demands: "Show me all flight records from the past X years." Many operators discover too late that they haven't kept records long enough. This guide details mandatory retention periods, what records matter, and how long you must store them.
Record Retention Summary
| Record Type | UK | Germany | France | Netherlands | Sweden | Australia | New Zealand | Canada | Japan |
|---|---|---|---|---|---|---|---|---|---|
| Flight Logs | 2 years | 3 years | 3 years | 3 years | 3 years | 2 years (Pt 101) / 7 years (ReOC) | 3 years (Pt 102) / Cert duration + 2 | 2 years | 2 years |
| Maintenance Records | 2 years | 3 years | 3 years | 3 years | 3 years | 2 years / 7 years (ReOC) | 3 years | 2 years | 2 years |
| Pilot Certificates | 5 years (duration) | 5 years (duration) | 5 years (duration) | 5 years (duration) | 5 years (duration) | 2 years + 1 after expiry | 2 years + 1 after expiry | 3 years + 1 after expiry | 1 year + 1 after expiry |
| Insurance Policies | 3 years | 3 years | 3 years | 3 years | 3 years | 3 years | 3 years | 3 years | 3 years |
| Risk Assessments (SORA) | Per operation | Per operation | Per operation | Per operation | Per operation | Per operation | Per operation | Per operation | 2 years |
| Incident Reports | 5 years | 5 years | 5 years | 5 years | 5 years | 5 years | 5 years | 5 years | 5 years |
| Operator Manual | Per version | Per version | Per version | Per version | Per version | Per version | Per version | Per version | Per version |
| Airspace Coordination | 2 years | 2 years | 2 years | 2 years | 2 years | 2 years | 2 years | 2 years | 2 years |
| Personal Data (GDPR-applicable) | 3 years + GDPR rules | 3 years + GDPR rules | 3 years + GDPR rules | 3 years + GDPR rules | 3 years + GDPR rules | 2 years (Privacy Act) | 2 years | 2 years | 2 years (APPI) |
United Kingdom (CAA Record Retention)
Flight Logs
Retention Period: 2 years minimum Authority Citation: CAP 393 Section 3.1, Small Unmanned Aircraft Order 2023 What Constitutes a Flight Log:- Date, time of flight
- Location (airfield/coordinates)
- Aircraft registration
- Pilot name/license number
- Flight duration (minutes)
- Altitude flown (AGL)
- Weather conditions (wind, visibility)
- Any incidents/near-misses
- Photographic/data capture (if applicable)
- Original or digital copy required
- Paper acceptable (if legible)
- Digital format: PDF, Excel, proprietary software (MmowW, etc.) all acceptable
- Must be retrievable within 24 hours for inspection
- CAA inspection: Common during compliance audits
- Non-compliance: Fine ยฃ1,000โ5,000 per missing record
- If flight operations documented elsewhere (project files, client timesheets), flight log specifics still required
- Pre-flight inspection results (checklists)
- Maintenance performed (date, task, technician)
- Repairs (parts replaced, work order reference)
- Modifications/upgrades
- Battery cycles (if applicable)
- Propeller condition
- Motor/gimbal functionality tests
- Software updates/firmware versions
- Digital or paper
- Must show maintenance timeline
- Technician signature/identification required
- Retention even after aircraft decommissioned (2 years post-retirement)
- Copy of A2 CofC certificate (front/back)
- Flyer ID confirmation (if recorded)
- GVC certificate (if applicable)
- Medical clearance (if required for operation type)
- Training/currency records (optional, but recommended)
- Digital scans acceptable (PDF)
- Original must be available for inspection
- Expiration tracking system required
- Full insurance certificate
- Coverage limits (public liability, property damage)
- Policy number and issuer
- Effective dates
- Exclusions/limitations
- Proof of payment (invoice/receipt)
- Digital copy + original policy
- Proof of ongoing renewal (annual reminder required)
- Audit-ready format (PDF with dates highlighted)
- All near-misses (including birdstrikes, airspace infringements)
- Any damage to aircraft
- Loss of control incidents
- Unintended landings
- Property damage
- Serious injury
- Written report (form required by CAA)
- Witness statements (if available)
- Photos of damage (if applicable)
- Timeline of events
- Date, time, duration
- Airfield/location (coordinates or named area)
- Aircraft registration + serial number
- Pilot name + license number
- Weather (wind speed/direction, visibility, cloud)
- Altitude flown
- Flight type (VLOS/BVLOS/training/operational)
- Any incidents
- Maintenance condition of aircraft documented
- Airspace approval reference (if applicable)
- Photo/data mission results (if commercial)
- Digital preferred (but paper acceptable)
- Legibility required (LBA can request enlargement)
- Retention even if aircraft sold (3 years post-sale)
- Searchable log recommended (LBA may search by date range)
- LBA inspection during operational audit
- Fine EUR 500โ5,000 per missing record
- Strict enforcement post-incident (every flight from 6 months prior audited)
- All scheduled maintenance (date, task, result)
- Unscheduled repairs
- Parts replacement (with part numbers, replacement dates)
- Calibration records (if sensors/camera require accuracy certification)
- Battery maintenance logs (cycles, degradation)
- Firmware updates (with version numbers)
- Chronological order
- Technician identification
- Cost records (if contract maintenance)
- A1 Online certificate (PDF acceptable)
- A2 CofC certificate (original or certified copy)
- STS certificates (if applicable)
- Medical examination results (if required)
- Training completion evidence (optional)
- Operational risk analysis
- Mitigation measures
- Approval date
- Approving authority signature
- Operation-specific conditions
- Date, time, duration
- Location (airfield code or GPS coordinates)
- Aircraft registration
- Pilot license number
- Weather conditions
- Altitude flown
- Any incidents/accidents
- Geolocation coordinates for cross-border flights
- Tourist flight zones: Additional documentation (if applicable)
- Military/restricted airspace: Approval reference
- Digital format preferred
- Searchable by pilot name or aircraft registration
- 3-year archival (after 3 years, deletion permitted)
- Policy document
- Proof of payment
- Coverage letter (from insurer)
- Renewal notices
- Date, time, duration
- Location
- Aircraft registration
- Pilot identification
- Weather
- Altitude
- Flight type (commercial/training/recreational)
- Water operations (coastal/canal): Additional location detail
- Airspace coordination: Reference number required
- Terminal areas (Amsterdam, Rotterdam): Special documentation
- Digital preferred
- ILT can request real-time access (via MmowW or similar platform)
- Standard flight log elements (date, time, location, pilot, aircraft)
- Weather conditions
- Incident notes
- Altitude logged
- Stockholm airspace: Additional coordination notes
- Coastal operations: Geolocation emphasis
- Transportstyrelsen can audit real-time logs
- Part 101 (Recreational/Simple Commercial): 2 years minimum
- Part 102 (Remote Operator Certificate - ReOC): 7 years minimum
- Date, time, duration
- Airfield/location
- Aircraft details
- Pilot name
- Weather conditions
- Incidents (if any)
- All Part 101 elements
- Altitude profile
- Airspace used
- Payload/mission type
- Maintenance condition before flight
- Any operational deviations
- Supervisor/observer signature (if applicable)
- Hot climate: Temperature impact on batteries documented (if relevant)
- Terrain variability: Altitude AGL carefully measured
- Indigenous land: Special notation if applicable
- CASA can inspect records without notice
- Paper or digital acceptable
- Searchable by aircraft registration
- Part 102 operators: Records must be immediately available (24-hour access not acceptable)
- CASA spot audits common
- Fine A$2,000โ10,000 per missing record
- ReOC suspension possible for systemic non-compliance
- Pre-flight inspection checklists
- Maintenance performed (date, task, technician)
- Parts replacement
- Repair log
- All accidents, serious incidents, near-misses
- Written report (form available via CASA)
- Photographic evidence (if applicable)
- Witness statements
- Part 101 (Recreational): 2 years
- Part 102 (Approved Operator): Duration of approved operation + 2 years after approval ends
- Date, time, duration
- Location
- Aircraft details
- Pilot name
- Weather
- Incidents
- All Part 101 elements (more detailed)
- Mission type/payload
- Airspace coordination references
- Maintenance status
- Supervisor identification
- Digital or paper
- CAA can request records within 7 days
- Searchable format required
- Inspection checklists
- Maintenance work orders
- Parts replacement history
- Battery cycle documentation
- Date, time, duration
- Location (airfield code or GPS)
- Aircraft registration
- Pilot name/RPIC designation
- Weather conditions
- Altitude
- Any deviations/incidents
- Cross-border flights: Entry point documented
- Indigenous land: Coordination with local authorities noted
- Winter operations: Temperature/precipitation impact recorded
- Digital or paper
- Searchable format (by date/location)
- Transport Canada can request within 14 days
- Pre-flight checks
- Maintenance performed
- Parts replaced
- Repairs and troubleshooting
- Accident/incident report (form available)
- Evidence documentation
- Witness statements
- Date, time, duration
- Location (airfield name + GPS coordinates)
- Aircraft registration number + pilot license number
- Weather conditions
- Altitude flown
- Flight type (commercial/training/testing)
- Incidents/deviations
- All text in Japanese or English + Japanese translation
- Geographic coordinates must reference Japanese grid system (if applicable)
- Special areas (national parks, protected zones): Additional documentation
- Notification number (if pre-flight notification was required)
- Digital format strongly preferred (NAA audits via digital logs)
- Cloud storage (MmowW, etc.) acceptable
- Paper backup required
- NAA can request logs within 24 hours
- NAA inspection routine (annual for commercial operators)
- Fine ยฅ100,000โ500,000 per missing record
- License suspension possible for systemic gaps
- Daily pre-flight inspection
- Maintenance performed (date, task, parts)
- Repairs/troubleshooting
- Modifications (if applicable)
- Battery/propeller condition
- License certificate (copy)
- Renewal records (proving annual renewal)
- Medical certification (if required)
- Training completion certificates
- All flight logs containing pilot/operator names must comply with GDPR
- Data minimization principle: Keep only names/IDs necessary for compliance
- Purpose limitation: Flight logs for regulatory compliance only (cannot use for unrelated purposes)
- 3 years for regulatory retention minimum (GDPR-compliant)
- Beyond 3 years: Legal basis must exist (e.g., incident investigation ongoing)
- Right to erasure: After 3 years + GDPR rules, pilots can request deletion (if not legally needed)
- Encryption at rest (password-protected Excel/PDF)
- Access controls (only authorized personnel)
- Breach notification (72-hour rule to DPA if pilot data exposed)
- Flight logs treated as personal information (pilot names, license numbers)
- APPs (Australian Privacy Principles) govern collection, storage, disclosure
- Not kept longer than necessary (2โ7 years per operation type)
- Secure destruction after retention period
- Right of access: Pilot can request their records
- Storage security (encrypted)
- Breach notification (OAIC within 30 days if serious breach)
- Consent required if sharing with third parties
- Flight logs treated as personal information
- Privacy Principles govern handling
- 2โ3 years typical
- Secure destruction after period
- Right of access maintained
- Flight logs with pilot names are personal information
- PIPEDA principles apply
- 2 years minimum (regulatory)
- Destruction after period required
- Security measures mandatory
- Flight logs with pilot names require APPI compliance
- Recent 2022 reforms increased requirements
- 2 years minimum
- Anonymization after 2 years (if further retention needed)
- Data breach notification required (if serious)
- Immune to cyber-attack
- Acceptable to all authorities
- Long-term durability (acid-free paper lasts 100+ years)
- Hard to search (audit takes longer)
- Space requirements (10+ pilots = multiple filing cabinets)
- Fire/flood risk
- Difficult to share with team
- Keep paper backup for critical records (A2 CofC, insurance, incident reports)
- Digitize everything else (flight logs, maintenance)
- Cloud storage: MmowW, Google Drive, Microsoft OneDrive, Dropbox
- On-premise: Company server, USB drive
- Hybrid: Cloud primary + local backup
- At-rest encryption: AES-256 minimum
- In-transit encryption: TLS 1.2+
- Acceptable: MmowW (end-to-end encryption), Google Drive, Microsoft OneDrive all meet standard
- 3-2-1 rule: 3 copies, 2 different media types, 1 off-site
- Example: Original cloud + local USB + cloud backup service
- Test restoration annually
- All records timestamped and versioned
- Automatic backup (daily)
- One-click PDF export (includes all records with dates highlighted)
- Search by pilot/aircraft/date range
- Non-editable log (prevents tampering)
- Flight logs (past 7 years, but retention periods highlighted)
- Maintenance records (with dates color-coded: green = current, yellow = expiring, red = overdue)
- Pilot certificates (with expiration status)
- Insurance (with renewal dates)
- Incidents (with timeline)
- Regulatory compliance checklist (auto-scored)
- Operator keeps flight logs for 18 months (savings: disc space)
- CASA audit arrives asking for past 2 years
- Logs missing for 6-month period
- Fine: A$5,000โ10,000
- All flight logs in spreadsheet on personal laptop
- Laptop dies/stolen
- All 2 years of records lost
- Audit: "Demonstrate your flight history"
- Fine: ยฃ5,000 (UK) for inability to produce records
- Operator keeps all records in shared Google Drive (Dropbox folder, email attachments)
- Personal files mixed with compliance records
- Audit: "Which records are official? Who had access?"
- Compliance questioned due to unclear chain of custody
- Pilot does pre-flight inspection (no checklist filled)
- Pilot performs minor repair (no work order)
- Audit: "When was the last maintenance?"
- No records = auditor assumes lack of maintenance = unsafe
- Compliance failing
- Operator keeps flight logs with full pilot names for 7 years
- Pilot requests deletion after 3 years (GDPR right to erasure)
- Operator refuses (claims regulatory retention)
- Data privacy regulator audit: Fine EUR 10,000+ (France CNIL)
- [ ] Flight logs: 2 years
- [ ] Maintenance: 2 years
- [ ] Certificates: Duration + 1 year
- [ ] Insurance: 3 years
- [ ] Incidents: 5 years
- [ ] GDPR: Names anonymized after 3 years
- [ ] Storage: Digital or paper, searchable format
- [ ] Flight logs: 3 years
- [ ] Maintenance: 3 years
- [ ] Certificates: Duration + 1 year
- [ ] Insurance: 3 years
- [ ] SORA/Risk: Per operation
- [ ] Incidents: 5 years
- [ ] GDPR: Names anonymized after 3 years
- [ ] Storage: Digital preferred, LBA audit access
- [ ] Part 101 logs: 2 years
- [ ] Part 102 logs: 7 years
- [ ] Maintenance: 2โ7 years
- [ ] Incidents: 5 years
- [ ] Privacy Act: Secure storage, breach notification
- [ ] CASA: Records immediately available
- [ ] Part 101 logs: 2 years
- [ ] Part 102 logs: Duration + 2 years
- [ ] Maintenance: 2 years (Part 101) / Duration + 2 (Part 102)
- [ ] Incidents: 5 years
- [ ] Privacy Act: Access rights maintained
- [ ] Flight logs: 2 years
- [ ] Maintenance: 2 years
- [ ] Incidents: 5 years
- [ ] PIPEDA: Security, breach notification
- [ ] Transport Canada: 14-day access requirement
- [ ] Flight logs: 2 years
- [ ] Maintenance: 2 years
- [ ] Pilot licenses: 1 year after expiry
- [ ] Incidents: 5 years (if serious)
- [ ] APPI: Breach notification required
- [ ] NAA: 24-hour audit access
- Flight log added โ Auto-marked with retention deadline (2โ7 years per country)
- Dashboard shows: "Record expires 2026-04-10" (3 years from entry)
- Auto-reminder at 30-day mark: "Consider archiving logs older than 3 years"
- Archive function: Move records to archive (searchable, but separate from active logs)
- All records encrypted at rest (AES-256)
- All records encrypted in transit (TLS 1.2+)
- Backup encrypted (daily backup, geographically distributed)
- Every access to record logged (who, when, what)
- Non-editable logs (all edits create version history, not overwrites)
- Export timestamp preserved (if auditor requests)
- Includes all records with retention-period highlights
- Green: Records within retention period
- Yellow: Records approaching deletion date
- Compliance checklist per country (auto-scored)
- Retention periods vary: 2 years (UK, AU Part 101, CA, JP) to 7 years (AU ReOC)
- GDPR adds complexity: EU/UK operators must anonymize names after 3 years (if not legally needed)
- Audit-ready format critical: Records must be searchable + retrievable within 24 hours
- Digital storage preferred: Cloud-based platforms (MmowW) offer backup + encryption + searchability
- One mistake = large fine: Missing record = EUR 1,000โ10,000 fine depending on country
- MmowW auto-manages: Retention dates auto-calculated per country, archives triggered automatically, audit PDF one-click