Record Retention

You're listening to HempDash Academy — practical compliance education for hemp retailers. Today's lesson: Record Retention. How long must a Texas hemp retailer keep records? For test results, the rule answers directly: at least three years from the date you receive them — and it names retailers. For most other records, the rule is silent for retailers, and this lesson keeps the line between rule and practice honest. In this lesson, you will learn: Answer 'how long do I keep test results?' with the exact rule — three years from receipt, 25 TAC §300.303(f). Know which record duties bind retailers by name, and which bind only manufacturers and processors. Recognize where the rule is silent for retailers — and treat silence as a reason for conservative practice, not invented requirements. Set up a retention file a regulator request can't embarrass. The short answer: three years for test results — and yes, that includes retailers. Texas answers the retention question for test results in one sentence. 25 TAC §300.303(f), in full: 'A manufacturer, processor, and retailer must retain results from samples for at least three years from the date that testing results are received.' The rule names retailers directly. If a COA or other lab result for a product you sell reaches you, the clock starts on the date you receive it, and you keep the document for at least three years. The retention duty travels with an availability duty. Under §300.303(b), a manufacturer, processor, distributor, and retailer must provide the results of required testing to the consumer, the Texas Alcoholic Beverage Commission, and DSHS on request. Retention is what makes that possible — a store that discarded its COAs cannot comply with a request it is required to honor. The statute behind these rules, Health and Safety Code Chapter 443, sets no retention period itself — its closest provision (Sec. 443.152(c)) just requires the manufacturer to make test results available to the seller. The three-year figure is DSHS's, in the Consumable Hemp Program rules as amended effective March 31, 2026. Everything in this lesson is Texas law; other states run their own regimes. Rule vs. practice: what the rule actually requires of a retailer. This lesson's spine is the line between what the rule commands and what careful stores do anyway. The rule side, for a retailer: Everything below that line in this lesson is operating practice — worth doing, clearly labeled, and not something an inspector can cite you for skipping. Rule requires: retain test results at least three years from the date received — §300.303(f), naming retailers.. Rule requires: provide those results to a consumer, TABC, or DSHS on request — §300.303(b).. Rule requires (out-of-state products): on request, submit evidence to DSHS that the products were compliantly processed or manufactured out of state — §300.403. No retention period is stated for that evidence.. Rule requires: display proof of your retail hemp registration prominently, visible to the public, and keep it current — an expired registration is not valid — §300.502(e), (c).. Rule requires: don't obstruct — refusing access to or copying of records, like refusing entry, inspection, or sampling, is a prohibited act — §300.602(3).. Rule elsewhere: records described in Chapter 300 must be kept no less than three years after they are created (§300.203(c)) — a second three-year clock, written generally. Which clock governs a retailer's COAs (creation vs. receipt) isn't spelled out; the conservative practice is to satisfy the later of the two.. Rule does NOT say: that retailers must keep purchase invoices, sales records, or supplier files. No general business-records rule in Chapter 300 names retailers.. Rule does NOT say: that retailers must log age checks. §300.701(b) requires verifying ID before every sale — it does not require recording that you did.. The records the rule doesn't make you keep — and why careful stores keep some anyway. Here is the honest part, stated plainly: apart from test results, Chapter 300 imposes no general record-keeping duty on retailers. The long record list in §300.203(d) — batch production records, receiving records, complaint files, destruction logs, master production records — opens with 'A consumable hemp manufacturer or processor must maintain…' and does not name retailers. That list is your supplier's obligation, not yours, and no one should tell you otherwise. So why keep more than the rule demands? Because every duty you do have is an on-request duty — results on request, provenance evidence on request, samples on request — and requests don't schedule themselves around your filing habits. The items below are guidance, not rule: Purchase invoices and shipping manifests — practice, not rule. They tie each lot on your shelf to a supplier and a COA, and they're your natural evidence if DSHS asks about an out-of-state product under §300.403.. Out-of-state provenance evidence (the supplier's license, state-plan documentation) — the duty to produce it on request is rule (§300.403); how long to keep it is not stated. Practice: keep it at least as long as the related test results.. A written age-verification policy or incident log — practice, not rule. The rule requires checking ID every time (§300.701(b)); it never requires a log. Worth noting: an apparently valid ID is a defense if a minor deceives your staff (§300.702(b)), which is exactly the kind of fact documentation helps establish.. Registration paperwork history (past certificates, renewal confirmations, amendment receipts) — practice. The rule requires the current registration displayed; keeping the trail is just cheap insurance.. Employee training records — practice. No Chapter 300 provision requires them for retailers.. Where and how to keep them. Format is the easy part: electronic records are fine. The rule's records-standards section says flatly that 'records can be electronic' (§300.203(e)), §300.303(f) prescribes no format for retained results, and the statute itself contemplates results delivered electronically (HSC §443.152(c)). A well-organized digital file — one folder or system entry per product and lot, COA attached — beats a paper binder on every axis that matters here. Accessibility is the part to take seriously. Chapter 300's access section (§300.203(a)) requires persons who must maintain records under the chapter to keep them on site for immediate inspection and to provide access for review or copying to DSHS or TABC on request. That section sits in the manufacturing subchapter, and whether its on-site clause reaches retail registrants is a genuinely open question — but a retailer is 'a person required to maintain records under this chapter' by §300.303(f), so the conservative posture is to act as if it applies: keep your COAs where the person behind the counter can produce them during an inspection, not in an owner's inbox three time zones away. Remember also that your registration application included written consent for regulators to enter the premises (§300.502(b)(7)), and refusing records access is a prohibited act (§300.602(3)(C)). One more reason the file has to be real: DSHS conducts random testing of consumable hemp products at retail (§300.302(c)) and can require you to hand over product samples at your expense (§300.302(d)). Your retained paperwork can be laid next to a fresh state-run lab analysis at any time. A three-year file of results you can produce on the spot is what makes that comparison boring instead of terrifying. Red flags. Patterns that turn a routine request into a finding: COAs get deleted or discarded when a product sells through — §300.303(f) runs at least three years from receipt, not until sell-through.. Test results live only in a departed employee's email or a supplier's portal login nobody has — if you can't produce them on request, you can't comply with §300.303(b).. No record of when a COA was received — the retention clock runs from receipt; if you can't date receipt, you can't prove the clock.. Out-of-state products on the shelf with no provenance evidence on file — §300.403 lets DSHS ask for it at any time.. The registration certificate on display is expired — an expired registration is not valid (§300.502(c)).. Anyone on staff who would say no, or stall, when an inspector asks to see records — refusal to permit access or copying is itself a prohibited act (§300.602(3)).. Here is a real-world example. A store owner sells through a batch of tinctures in March and, tidying the shared drive, deletes the folder — product's gone, why keep the paperwork? Fourteen months later a TABC inspector, following up on a consumer complaint about that brand, asks for the test results for the lots the store sold. Under §300.303(b) the store must provide them on request, and under §300.303(f) it was required to still have them — the three-year clock from receipt had almost two years left to run. The store is now explaining an empty folder instead of handing over a PDF. The counterfactual costs nothing: a per-lot folder, COA filed on arrival with the received date noted, nothing deleted for three years. The same request becomes a two-minute email — and the complaint investigation moves on to the manufacturer, where the batch records actually live. Key takeaways. The one retention rule that names retailers: keep test results at least three years from the date received — 25 TAC §300.303(f). Retention exists to serve availability: consumers, TABC, and DSHS can all demand your results on request (§300.303(b)), and refusing records access is itself a violation (§300.602(3)). Beyond test results, Chapter 300 is silent on retailer records — the big record list in §300.203(d) binds manufacturers and processors. Keep invoices, provenance evidence, and age-check policies as practice, and know which is which. Electronic files are fine; producible files are the point. Date each result when it arrives, delete nothing for three years, and keep the file where staff can open it during an inspection. And finally, the checklist: Record retention checklist. Every product/lot on the shelf has its test results (COA) on file — retained at least three years from the date received (§300.303(f)). Each filed result is dated with when you received it, so the retention clock is provable. Nothing is deleted at sell-through — sell-through doesn't stop the three-year clock. Results are retrievable on the spot, by staff on duty — not locked in one person's email (supports §300.303(b) and the conservative §300.203(a) reading). Out-of-state products have provenance evidence on file, kept at least as long as the related test results (§300.403 — duty is rule, period is practice). Current registration displayed conspicuously; renewal calendared before expiry (§300.502(e), (c)). Practice items, clearly optional: purchase invoices per lot, a written age-check policy, registration history, training notes. Staff know the house rule for inspections: never refuse records access — refusal is itself a violation (§300.602(3)). You've completed this HempDash Academy lesson. Test what you learned below, or see how HempDash can help put it into practice. This recording is educational information, not legal advice — rules change, so verify current requirements with DSHS and your attorney.