Safety data sheet program: the complete OSHA compliance guide

Last updated 2026-07-10

What is a safety data sheet program and who is required to have one?

A safety data sheet program is the written system a company keeps to collect, store, and give employees access to safety data sheets for every hazardous chemical they might be exposed to at work. It is more than a binder on a shelf. It is a documented process covering how SDSs get obtained when new chemicals arrive, where they live, how workers reach them mid-shift, and how stale sheets get swapped out.

The requirement comes from OSHA's Hazard Communication Standard, 29 CFR 1910.1200, which applies to any general-industry employer with hazardous chemicals in the workplace ^[1]. Construction and agriculture have parallel rules under 29 CFR 1926.59 and 29 CFR 1928.21, but the substance is the same. Buy, use, store, or produce a chemical that meets OSHA's hazard definition, and you need a program.

OSHA defines a hazardous chemical as "any chemical which is classified as a physical hazard or a health hazard, a simple asphyxiant, combustible dust, pyrophoric gas, or hazard not otherwise classified" under 29 CFR 1910.1200(c) ^[1]. That is a wide net. Cleaning products, paints, solvents, compressed gases, and plenty of ordinary shop supplies qualify.

Hazard Communication is one of OSHA's most frequently cited standards, year in and year out. In federal fiscal year 2023 it drew 2,182 violations, ranking second overall behind fall protection ^[2]. Most of those citations are not for exotic substances. They are for missing SDSs, boilerplate written programs, and workers who were never trained.

What does a written hazard communication program actually have to say?

The written program is the spine of your SDS system. Under 29 CFR 1910.1200(e), employers must develop, implement, and maintain a written hazard communication program covering, at minimum, how labels are managed, how SDSs are kept and made accessible, and how employees are trained ^[1].

In plain terms, your written program has to spell out four things:

1. A list of all hazardous chemicals in your workplace. Call it a chemical inventory or a hazardous materials list. It does not need to be fancy. It does need to exist and stay current.

2. Where SDSs are kept and how any employee on any shift reaches them immediately. "Immediately" is OSHA's word, not ours. A binder in a locked manager's office does not clear that bar.

3. How you get SDSs for new chemicals before they arrive or get used the first time.

4. How you train employees and keep records of that training.

Plenty of small businesses add a section on non-routine tasks (cleaning a tank, servicing a process line) and one on contractors. Under 29 CFR 1910.1200(e)(2), if other employers send workers into your facility, you must give those employers access to your SDSs for chemicals their people might encounter ^[1]. That is not the same as handing over your whole binder. It means making sure they can reach the sheets that matter to their work.

Your written program does not have to run long. OSHA's own guidance says it can be short for a small business with few chemicals. What it cannot be is vague. "SDSs are available upon request" is not an access plan. It is a citation waiting to happen.

What is the GHS 16-section SDS format and what does each section cover?

The United States adopted the Globally Harmonized System of Classification and Labelling of Chemicals (GHS) in 2012, when OSHA revised its HazCom standard. Since June 1, 2015, every SDS from a chemical manufacturer has to use the standardized 16-section format ^[3]. As an employer, you do not write SDSs unless you manufacture chemicals. You receive them from suppliers and manage them.

Knowing the 16 sections lets you check that a sheet is complete and find what you need fast in an emergency.

Section	Name	What it tells you
1	Identification	Product name, manufacturer, emergency phone
2	Hazard identification	GHS hazard class, signal word, pictograms
3	Composition/ingredients	Chemical identity, CAS numbers, trade secrets
4	First-aid measures	What to do for exposure by route (skin, eye, inhalation, ingestion)
5	Fire-fighting measures	Extinguishing agents, special hazards
6	Accidental release measures	Spill containment, cleanup procedures
7	Handling and storage	Safe use practices, storage temperature, incompatibilities
8	Exposure controls/PPE	OSHA PELs, ACGIH TLVs, required PPE
9	Physical and chemical properties	Flash point, boiling point, pH, vapor pressure
10	Stability and reactivity	Conditions to avoid, incompatible materials
11	Toxicological information	LD50, routes of exposure, target organs
12	Ecological information	(Not enforced by OSHA in the U.S.)
13	Disposal considerations	(Not enforced by OSHA in the U.S.)
14	Transport information	(Not enforced by OSHA in the U.S.)
15	Regulatory information	Other regulations that apply
16	Other information	Revision date, preparer info

Sections 12 through 15 have to be present in the SDS, but OSHA does not enforce their content. That matters when you evaluate a sheet for completeness. If sections 1 through 11 are present and complete, the document meets OSHA's format requirement ^[3].

Here is a practical tell. If you receive a material safety data sheet (MSDS) in the old format with fewer than 16 sections, it is probably outdated. Push your supplier for a current GHS-compliant SDS. Keeping an old MSDS for reference is not illegal, but relying on it for current hazard information is a risk you do not need to take.

How do you build and organize an SDS library?

Your SDS library is the collection of current safety data sheets for every hazardous chemical at the site. Building it starts with your chemical inventory, not with the binder.

Walk your facility and list every product that could be hazardous. Skip nothing. Not the janitorial closet, not the break room (oven cleaner, sanitizer), not the maintenance bay. For each product, note the manufacturer and request an SDS directly from them or your distributor. Most manufacturers post SDSs online, and OSHA links to manufacturer databases and other tools through its HazCom resources page ^[4].

Once you have the sheets, you need a system. Physical binders work fine for small shops. Organize them alphabetically or by work area, whichever gets a worker to the right sheet in under a minute. Label the binder. Put it somewhere every shift can reach without a key.

Digital systems are common now, and OSHA accepts them with one hard condition: electronic access has to be immediate and reliable. If the system goes down, workers need a backup. A terminal that demands a password, takes three minutes to boot, or sits only in the manager's office fails the "immediately accessible" test. OSHA's letters of interpretation have held consistently that electronic SDS systems are fine as long as employees can reach the sheets without barriers during their shift ^[5].

For multi-location businesses, a cloud SDS platform can hand every site a central library and flag when manufacturers update a sheet. ChemWatch, VelocityEHS, and MSDSonline are established options (this is not an endorsement). The cost is real, roughly $1,500 to $5,000 a year for a small-business tier, but it kills the common failure of a site running on a three-year-old binder because nobody kept it current.

Update the library whenever a new chemical enters the building, and at least once a year otherwise. Read each sheet's revision date. Anything older than five years earns a fresh request to the supplier.

What are the OSHA rules for SDS accessibility during a work shift?

This is where businesses fail inspections. OSHA's 29 CFR 1910.1200(g)(8) says employers must ensure SDSs are "readily accessible during each work shift to employees when they are in their work area(s)" ^[1]. OSHA's letters of interpretation have clarified "readily accessible" over and over to mean no barriers that could delay access in an emergency ^[5].

Here is what that looks like on the floor. A night-shift worker who needs the SDS for a solvent at 2 a.m. has to get it without calling a manager or waiting for someone to unlock a room. A warehouse worker who gets splashed needs the first-aid section in seconds, not minutes.

A few scenarios OSHA has addressed:

Centralized binders are fine, as long as they sit in an accessible area with no lock and workers know exactly where. One binder for a sprawling facility with several buildings may not count as readily accessible to everyone.

Electronic systems require terminals in or near work areas, a system that runs during every shift, and a backup plan (often a printed subset of sheets for the high-hazard chemicals) for outages.

Off-site and traveling workers (construction crews, service techs) need access to SDSs for whatever they carry or use. A binder or tablet in the work vehicle, or a mobile app tied to the company database, usually handles it.

OSHA does let employers keep SDSs at one central location for a multi-employer worksite, as long as the written program describes the setup and workers know how to use it quickly. Write the system down.

What SDS training do employees need under OSHA HazCom?

Training is not optional, and it is not one and done. Under 29 CFR 1910.1200(h), employees must be trained on the hazards of chemicals in their work area at initial assignment and whenever a new chemical hazard shows up ^[1]. The standard names the topics training has to cover.

Employees have to be able to explain where SDSs are and how to reach them, how to read a label and interpret GHS pictograms, what the physical and health hazards of chemicals in their area are, and what protective measures to take. That last point wires your SDS program straight into your hazardous communication program and your PPE requirements.

OSHA does not mandate a format or a minimum number of hours. Classroom, video, computer-based, one-on-one, all of it satisfies the rule if the content is there and you can prove people understood. The proof is the part that trips businesses up. Keep records of who was trained, on what chemicals, on what date, by what method. A sign-in sheet is the floor. A short written quiz is better, because it documents comprehension, which is exactly what OSHA asks about.

See SDS training as one piece of a larger system, not a standalone chore. For a fuller workplace safety training program that folds HazCom in with your other required topics, that framing saves you from treating each requirement as its own island.

Retraining kicks in when a new physical or health hazard enters the workplace. Start using a new solvent with an inhalation risk your crew has not seen? Train before first use. If a supplier updates an SDS with new hazard information, that can trigger a training obligation too, depending on how big the change is.

One thing OSHA does not require: annual refresher training as a fixed rule. No new chemicals, no changes in hazard information, and the initial training still stands. Even so, most safety pros run an annual touchpoint anyway. People forget, and turnover resets the clock.

What are the labeling requirements connected to your SDS program?

SDSs and labels are two halves of the same job. Under 29 CFR 1910.1200(f), every container of a hazardous chemical must be labeled ^[1]. For containers from manufacturers, the label needs the product identifier, a signal word (Danger or Warning), hazard statements, precautionary statements, GHS pictograms, and the supplier's name and contact information.

Secondary containers get treated differently. When you transfer a chemical from its original container into a smaller one for use, you need a label that at least names the product and its primary hazards. The one exception: a secondary container used up entirely during the same shift by the same person who filled it. Once that shift ends or the container leaves that person's hands, it needs a label.

Your written program should describe the labeling procedure. Who checks incoming containers? Who labels secondary containers, and with what? A roll of chemical-resistant labels and a marker covers most workplaces. Pre-printed labels from your SDS software are better, because they pull GHS data straight from the sheet.

Pipes, tanks, and process equipment run under a different standard. OSHA lets employers use signs, placards, batch tickets, or other written materials instead of individual labels on these, as long as employees have immediate access to the SDS or equivalent hazard information for whatever runs through the system.

Labeling violations often ride shotgun with missing SDSs on the same citation. In OSHA inspections of small manufacturers and auto shops, both show up together because they share a root cause: no real system for tracking what chemicals are on-site and what information workers need.

How do you handle SDSs for chemicals your company produces or mixes on-site?

If your company creates a hazardous chemical (mixing cleaning compounds, blending solvents, making a product workers handle), you are the manufacturer for that product, and HazCom requires you to prepare an SDS for it ^[1]. This is less common for small businesses, but it turns up in food processing (cleaning concentrates), construction (mixing joint compounds or coatings), and light manufacturing.

Writing an SDS from scratch is heavier lifting than filing received sheets. You have to classify the hazards of your mixture using OSHA's classification criteria, which usually takes either someone with toxicological knowledge or access to the SDSs for every component chemical. Many employers in this spot hire an industrial hygienist or a chemical classification consultant for the first SDS, then update it as the formula changes.

OSHA allows trade secret protection for chemical identities under 29 CFR 1910.1200(i). You can withhold the specific identity of a trade-secret ingredient from the SDS as long as the sheet discloses that a trade secret is present, provides all required health hazard information without revealing the identity, and you agree to disclose the identity to health professionals treating exposed workers ^[1]. This provision is tightly controlled. OSHA has issued detailed guidance on what counts as a legitimate trade secret claim, so do not assume the label "proprietary" does the work for you.

What does OSHA actually cite companies for in an SDS inspection?

Knowing the citation patterns lets you audit yourself before an inspector does. Based on OSHA enforcement data and the structure of the HazCom standard, the common deficiencies fall into these buckets ^[2]:

1. Missing SDSs. A worker is using a chemical and there is no sheet in the building for it. This hits hardest with cleaning products and lubricants nobody realized were classified hazardous.

2. SDSs not accessible. The binder is locked, the software needs a login employees do not have, or the sheets sit in a manager's office a building away.

3. No written program, or a template someone downloaded and never tailored to the actual chemicals on-site.

4. Outdated SDSs. Pre-GHS MSDS documents still in service as if they were current.

5. Missing or incomplete labels on secondary containers.

6. Training not documented. People may have been trained informally, but there are no records to show it.

7. Chemical inventory not maintained. The written program points to an inventory that does not exist or has not been touched in years.

OSHA penalties for HazCom violations were adjusted in 2023. Serious violations carry a maximum of $15,625 per violation, and willful or repeated violations can reach $156,259 per violation ^[6]. For a small business with 10 missing SDSs and no written program, that math gets ugly fast. The upside: OSHA runs an informal conference process and usually cuts initial penalties hard for small employers who fix violations promptly and cooperate with the inspection.

How do you run an SDS program self-audit before OSHA shows up?

A self-audit does not need to be elaborate. It needs to be honest. Run this sequence at least once a year, plus whenever you add chemicals or change your workforce.

Start with the chemical inventory. Walk every area and collect every chemical product you find. Check the SDS library against that list. A chemical on the shelf with no sheet is your first fix. For each sheet in the library, check the product identifier against what is actually on hand. Names change, formulas change, and old sheets linger.

Check revision dates. Anything over five years old gets re-requested from the manufacturer.

Test accessibility. Have someone simulate needing a sheet on a night shift. Can they find it? How long does it take? Over a minute or two, and your system needs work.

Review the written program. Does it describe your current chemicals and locations? Does it name your current storage method? Does it name the person responsible for the library? If that person left, update the program today.

Pull the training records. For every employee working with hazardous chemicals, can you show a record with a date, the chemicals covered, and the method used? Are new hires in there?

Check labels in the work areas. Walk through watching for secondary containers, transfer containers, and any unlabeled pipe or tank.

Found gaps? Document them and fix them in order of severity. Missing and inaccessible SDSs come first, because they are the most likely to hurt someone and the most likely to draw a big citation.

If you are building or rebuilding your safety documentation from a blank page, SafetyFolio's safety program generator can produce a written HazCom program and your other required written programs in a fraction of the time drafting from scratch takes. That leaves your hours for the physical inspection work, which is where the real compliance lives, instead of word processing.

How do state-plan states handle SDS requirements differently?

Twenty-nine states and territories run OSHA-approved state plans with their own occupational safety programs ^[7]. A state plan has to meet or exceed the federal standards, so its HazCom rules are at least as protective as 29 CFR 1910.1200, and often carry extra requirements on top.

California's Cal/OSHA program is the standout. California has its own Hazard Communication Standard (8 CCR 5194) that mirrors the federal rule in most respects but layers in requirements tied to chemicals regulated under California's Proposition 65 ^[8]. Employers in California working with Prop 65 chemicals (a long list of carcinogens and reproductive toxicants) have notification duties well beyond what a standard SDS program covers.

Washington State's Labor and Industries (L&I) runs its own HazCom rules and has historically moved faster than federal OSHA on adopting GHS updates. Oregon, Michigan, and North Carolina enforce their own versions too.

The practical takeaway: if you operate in a state-plan state, check your state agency's website for addenda to the federal standard. For most small businesses the differences are minor. California employers are the exception, and they should review Prop 65 obligations separately from the federal HazCom checklist.

What are the SDS retention requirements and how long do you keep records?

OSHA's HazCom standard sets no specific retention period for SDSs in the main 1910.1200 text. A related standard fills that gap. Under 29 CFR 1910.1020, the Access to Employee Exposure and Medical Records standard, employers must retain records of employee exposure to toxic substances ^[9]. OSHA's interpretation: SDSs for chemicals workers were exposed to can count as exposure records under 1910.1020, which carries a 30-year retention requirement.

That 30-year rule catches a lot of owners off guard. It does not mean keeping every SDS you ever touched for 30 years. It means that if employees were actually exposed to a chemical, the SDS for that chemical (or equivalent exposure information) should be kept for the duration of employment plus 30 years.

In practice, most businesses keep current sheets in the active library and archive superseded ones for the substances their workers actually used or were exposed to. Digital archives make this easy. A folder labeled by year, holding the sheets active during that year, costs almost nothing on a server.

For chemicals on-site that workers never directly touch (sealed storage, chemicals used only by a contractor), the case for 30-year retention is weaker. The risk of tossing records is still real if a former employee files a claim years later.

Keep training records on the same logic: as long as the employee works for you, plus a buffer. Most employment attorneys advise holding safety training records at least five years after the employee leaves.

Frequently asked questions

Do I need an SDS for every single chemical in my workplace, including common household cleaners?

Yes, if those products get used in a work setting and are classified hazardous under 29 CFR 1910.1200. Many common cleaners, degreasers, and sanitizers are classified hazardous chemicals. Household products used exactly as a consumer would use them at home fall under a narrow exemption, but the moment they get used at work in larger quantities or with greater frequency, that exemption usually drops away. In doubt, request an SDS from the manufacturer.

What is the difference between an SDS and an MSDS?

An MSDS (Material Safety Data Sheet) is the pre-2015 format with varying section counts and no standard layout. An SDS (Safety Data Sheet) is the GHS-compliant 16-section format required since June 1, 2015. The information overlaps, but the SDS format is standardized, so the same type of information always lands in the same section. If your library still holds MSDS documents, replace them with current SDSs from your suppliers.

Can employees access SDSs on their phones through a mobile app?

Yes. OSHA accepts mobile access as long as the system is immediately available to every employee during their shift, works reliably, and adds no step that would create a barrier in an emergency. You still need a documented backup plan for outages. If the app requires a personal account or a paid subscription employees do not have, it fails the accessibility test. Write your access method into your written HazCom program.

How often do I have to update my SDS library?

Whenever you add a new chemical, and whenever a supplier sends a revised SDS. OSHA sets no fixed annual update cycle, but reviewing the library at least once a year is good practice. Check revision dates on each sheet. If a supplier has issued a new SDS since you last received one, that may mean the hazard classification changed, which can shift your training and PPE requirements too.

Do I need SDSs for chemicals that are stored but never opened?

Yes. Storage does not erase the hazard. A sealed drum can leak, react, or need emergency handling. OSHA's standard covers hazardous chemicals in the workplace whether or not they are actively in use. Put all stored chemicals in your inventory and library. The narrow exception is small quantities of consumer products in original sealed packaging used in amounts comparable to normal consumer use. Commercial quantities clearly fall outside that.

What happens if a manufacturer cannot provide an SDS for a product I bought?

First, confirm the product is actually classified hazardous. If it is and the manufacturer refuses or cannot supply an SDS, you have options: stop using the product until you have the sheet, switch to a supplier who provides one, or contact OSHA for guidance. OSHA can compel manufacturers to provide SDSs under HazCom. In practice most manufacturers post sheets online, and a direct call to their regulatory affairs department usually resolves it.

Are there SDS requirements specific to small businesses with fewer than 10 employees?

The HazCom standard applies to every employer with at least one employee who may be exposed to a hazardous chemical. There is no small-business exemption. OSHA does acknowledge the written program can be simpler for very small operations. OSHA also runs a free consultation program, separate from enforcement, that helps small businesses audit their HazCom program with no penalty risk. Contact your regional OSHA office to schedule a free consultation visit.

What is OSHA's definition of 'immediately accessible' for SDS storage?

OSHA has not fixed a number of seconds, but its letters of interpretation hold consistently that 'immediately accessible' means employees can obtain SDS information without delay during their shift, without a supervisor's intervention, and without any barrier such as a locked door, a required password, or a long walk to another building. The test: can a worker in or near the work area reach the information quickly enough to use it in an emergency?

Do contractors working in my facility need access to my SDSs?

Yes. Under 29 CFR 1910.1200(e)(2), if employees of other employers work in your workplace, you must give their employers access to your SDSs for chemicals those workers may encounter. You also have to share information about any labeling system you use and fold them into your HazCom program to the extent they may be exposed. Businesses that use outside cleaning, maintenance, or construction contractors overlook this one all the time.

Can OSHA fine me if an SDS is present but employees do not know where it is?

Yes. Sheets filed somewhere in the building is not the same as making them readily accessible. Citations for inaccessible SDSs are common even when the documents exist, because employees were never told where they are or how to find them. Your training has to cover the location of your SDS library and how to pull a sheet during a shift. Document that training.

What GHS pictograms should employees be able to identify?

There are nine GHS hazard pictograms, and employees should recognize all nine: health hazard (exclamation mark), serious health hazard (silhouette), flame, flame over circle (oxidizer), gas cylinder, corrosion, exploding bomb, skull and crossbones (acute toxicity), and environment (not enforced by OSHA but present on many SDSs). Training must cover what each means and what protective action it implies. OSHA's free HazCom materials include visual aids for each pictogram.

Does a food manufacturing facility need a different kind of SDS program?

The basic HazCom requirements are the same, but food manufacturers usually carry a larger stock of cleaning chemicals, sanitizers, and allergen-related products than many industries. SDSs for food-grade cleaning chemicals are sometimes harder to get because suppliers assume their customers do not need them, which is wrong. A food safety certification program handles food safety hazards, but that is a separate layer from the chemical hazard communication requirements of HazCom.

How does a good safety and health program connect to the SDS program?

Your SDS program is one element inside a broader safety and health program. The chemical hazard information in your SDSs should feed your exposure controls, PPE selection, emergency response procedures, and medical surveillance decisions. Understanding what a safety and health program should be at a structural level shows you how SDS management flows into hazard identification, risk assessment, and corrective action across the whole program.

What training records do I actually need to keep for SDS and HazCom training?

OSHA does not name a format, but you need to show, for each employee, that they were trained, when, on which chemicals or categories, and by what method. A sign-in sheet with date, trainer name, and topics covered is the minimum. A short post-training quiz or acknowledgment form is better, because it documents that you verified comprehension. Keep these records at least for the duration of employment and ideally five years after separation.

Sources

1. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: HazCom applies to all employers with employees exposed to hazardous chemicals and requires written program, SDS library, labels, and training
2. OSHA, Top 10 Most Frequently Cited Standards FY2023: Hazard Communication drew 2,182 violations in federal fiscal year 2023, ranking second overall behind fall protection
3. OSHA, Hazard Communication and GHS 16-section SDS format guidance: Since June 1, 2015, all manufacturer SDSs must use the standardized GHS 16-section format; sections 12-15 must be present but OSHA does not enforce their content
4. OSHA, HazCom resources page: OSHA links to manufacturer SDS databases and other HazCom compliance resources
5. OSHA, Letters of Interpretation on Hazard Communication (standard number 1910.1200): OSHA letters of interpretation confirm electronic SDS systems are acceptable if immediately accessible without barriers during all shifts
6. OSHA, Penalties page: Serious violations carry a maximum penalty of $15,625 per violation; willful or repeated violations up to $156,259 per violation as adjusted in 2023
7. OSHA, State Plans page: Twenty-nine states and territories have OSHA-approved state plans that enforce occupational safety rules at least as protective as federal OSHA
8. California Department of Industrial Relations, Cal/OSHA: California enforces its own Hazard Communication Standard (8 CCR 5194) with added obligations tied to Proposition 65 chemicals
9. OSHA, 29 CFR 1910.1020 Access to Employee Exposure and Medical Records: Employers must retain records of employee exposure to toxic substances, including SDSs constituting exposure records, for duration of employment plus 30 years
10. OSHA, On-Site Consultation Program for small businesses: OSHA offers free on-site safety consultation to small businesses separate from enforcement, with no penalty risk for participating employers