Digital evidence in occupational risk prevention

What is digital evidence in occupational risk prevention?

In occupational risk prevention, the obligation doesn’t end with simply doing things right: it must be demonstrable. Article 23 of Law 31/1995 requires employers to prepare and keep available for inspection by the labor authority a prevention plan, a risk assessment, preventive planning, adopted protective measures, health status checks, and a record of accidents and occupational diseases. In addition to this basic documentation, preventive practices generate numerous records: delivery of personal protective equipment, information and training, work permits, inspections, coordination of activities, drills, equipment maintenance, and risk reports.

Digitization has transferred these records from paper to management systems: a form signed on a tablet, a geolocated photograph of an inspection, a training attendance record with an electronic signature, the trace of who modified an assessment and when, or the data from a gas sensor. Digital evidence is how these records prove facts. For it to serve as proof and a guarantee of compliance, it must meet three conditions: authenticity (it comes from the source it claims to), integrity (it has not been altered since its creation), and traceability (it is known who generated and modified it, when, and how).

Law 1/2000, on Civil Procedure, and Law 36/2011, regulating social jurisdiction, admit electronic means of proof, and Regulation (EU) 910/2014 (eIDAS) establishes the legal effects of electronic signatures and seals and of trust services. The Labor Inspectorate accepts documentation in electronic format provided it is accessible, legible, and verifiable during the visit.

Types of evidence and requirements

• Electronic documents. Evaluations, plans, procedures and reports with version control, approval date and responsible party, stored in a repository with a change log.
• Electronic signatures. Accreditation of delivery of PPE, information and training, work permits or meeting minutes by means of simple, advanced or qualified electronic signature according to the level of guarantee required, in accordance with the eIDAS Regulation and Law 6/2020.
• Activity logs and audit trails. System logs that record who creates, queries, or modifies each piece of data, with a timestamp; they are the basis of traceability and must not be able to be altered by users.
• Photographs and videos. With date, time, author and, where applicable, geolocation, linked to the record of the inspection, the incident or the measure; their capture must respect privacy and data protection regulations.
• Data from sensors and devices. Exposure measurements, gas detection, location of people in risk areas or equipment alarms, with device identification, calibration and storage.
• Communications. Emails, platform notifications and notices that provide information to workers, contractors or representatives, with acknowledgment of receipt when relevant.

Preservation and evidentiary value

• Timeframes. Preventive documentation is kept while it is valid and, in certain risks, for very long periods: exposure records to carcinogenic, biological or ionising radiation agents must be kept for decades according to their specific regulations, which requires durable formats and media.
• Integrity. Timestamping, hash functions, version control and backups ensure that the record has not been altered; the qualified electronic signature provides the highest legal presumption.
• Availability. Immediate accessibility in inspections and audits, with the possibility of exporting and verifying; the formats must remain legible throughout the retention period.
• Data protection. Records containing personal data, and especially health data, require a legal basis, minimization, access control and retention periods in accordance with the General Data Protection Regulation and Organic Law 3/2018.
• Judicial assessment. Courts assess electronic evidence based on the reliability of the system; a consistent audit trail and a documented procedure for generation and custody reinforce its credibility, while documents that can be manipulated without control lose value.

Organizational application: how to manage digital evidence

1. Identify which preventive obligations must be accredited and what record constitutes the evidence of each one (assessment, planning, training, delivery of PPE, inspections, coordination, health surveillance).
2. Centralize records in a preventive management system with version control, unalterable audit trails, and role-based access.
3. Define the appropriate level of electronic signature for each record according to its legal relevance and use timestamping when necessary.
4. Establish the procedure for capturing photographs and sensor data with identification of author, date, device and link to the corresponding registry.
5. Set retention periods by type of record, including long-term retention periods as per specific regulations, and ensure backups and future readability.
6. Apply data protection regulations: risk analysis, minimization, control of access to health data and the rights of individuals.
7. Prepare for export and verification of evidence for inspections, audits and procedures, and periodically test the process.

Preventive management software with audit trails, electronic signatures, and version control turns every action into verifiable evidence, facilitates its presentation to third parties, and reduces the risk of loss or manipulation of documentation.

Limits and common mistakes

1. Storing documents in editable formats without version control or traceability allows their integrity to be questioned.
2. Using scanned signatures or acceptance boxes without reliable identification of the person when the record has legal relevance.
3. Capturing photographs or data of people without legal basis or information, violating data protection and privacy.
4. Do not define retention periods or ensure the long-term legibility of the formats.
5. Scattering evidence across emails, personal folders, and messaging applications without centralized custody.
6. Confusing having evidence with compliance: the record proves the action, but does not replace it.

The specific probative value of each piece of evidence is determined by the courts on a case-by-case basis; this document is for informational purposes only.

Regulatory framework in Spain, in the European Union and comparative references

• Law 31/1995, article 23. Documentation that the employer must prepare and keep available for the labor authority.
• Regulation (EU) 910/2014 (eIDAS) . Electronic identification and trust services: legal effects of electronic signatures, seals and timestamps.
• Law 6/2020, of November 11. Regulation of certain aspects of electronic trust services.
• Law 36/2011, of October 10, regulating social jurisdiction . Means of proof, including electronic media, in labor proceedings.
• Regulation (EU) 2016/679, General Data Protection Regulation . Processing of personal data in preventive registers.

The ISO 45001 standard requires control of the documented information of the management system (creation, updating, access, preservation and disposal); in Colombia, Decree 1072 of 2015 establishes the documents and records of the SG-SST and their retention periods, with a minimum period of twenty years, counted from the termination of the employment relationship, for certain records.