Regulation (EU) 2020/359
(a) The competent authority shall establish a system of record-keeping providing for adequate storage, accessibility and reliable traceability of:
(1) the management system’s documented policies and procedures;
(2) training, qualification and authorisation of its personnel;
(3) the allocation of tasks, covering the elements required by ARA.GEN.205 as well as the details of tasks allocated;
(4) certification and declaration processes as well as oversight of certified and declared organisations;
(5) processes for issuing personnel licences, ratings, certificates and attestations and for the continuing oversight of the holders of those licences, ratings, certificates and attestations;
(6) processes for issuing FSTD qualification certificates and for the continuing oversight of the FSTD and of the organisation operating it;
(7) oversight of persons and organisations exercising activities within the territory of the Member State, but overseen or certified by the competent authority of another Member State or the Agency, as agreed between these authorities;
(8) the evaluation and notification to the Agency of alternative means of compliance proposed by organisations and the assessment of alternative means of compliance used by the competent authority itself;
(9) findings, corrective actions and date of action closure;
(10) enforcement measures taken;
(11) safety information and follow-up measures;
(12) the use of flexibility provisions in accordance with Article 71 of Regulation (EU) 2018/1139; and
(13) the evaluation and authorisation process of aircraft laid down in points ORA.ATO.135 (a) and DTO.GEN.240 (a).
(b) The competent authority shall establish and keep up to date a list of all organisation certificates, FSTD qualification certificates and personnel licences, certificates and attestations it issued, DTO declarations it received, and the DTO training programmes it verified or approved for compliance with Annex I (Part-FCL), Annex III (Part-BFCL) to Commission Regulation (EU) 2018/395, or Annex III (Part-SFCL) to Commission Implementing Regulation (EU) 2018/1976.
(c) All records shall be kept for the minimum period specified in this Regulation. In the absence of such indication, records shall be kept for a minimum period of 5 years subject to applicable data protection law.