A business record retention policy sets how long you keep each category of document before disposing of it, and federal law makes that period run anywhere from one year to permanently depending on the record. Tax records generally sit in a three-to-seven-year window, core payroll records three years, benefits records six years or longer, employee medical and chemical-exposure records 30 years past employment, and formation documents forever. A single blanket rule such as “keep everything seven years” leaves gaps on the long end and wastes storage on the short end.
Tax Records
Federal regulations require businesses to keep books and records sufficient to establish gross income, deductions, and credits reported on a return, for as long as they remain relevant to tax administration.1GovInfo. 26 CFR 1.6001-1 Records “Relevant” is tied to the IRS assessment window.
In the standard case, the IRS has three years from filing to assess additional tax. If a return understates gross income by more than 25 percent, the window extends to six years. If a return is fraudulent or never filed, there is no time limit at all.2Office of the Law Revision Counsel. 26 USC 6501 Limitations on Assessment and Collection3Internal Revenue Service. Time IRS Can Assess Tax
The familiar “seven-year rule” is essentially the six-year substantial-omission period plus a one-year buffer. Three years is the statutory floor when everything on the return is accurate. Records supporting a worthless securities or bad-debt deduction should be kept for seven years from the year the loss was claimed.
Employment tax records run on a separate clock. The IRS requires retention of payroll tax records, W-2s, and W-4s for at least four years after the tax becomes due or is paid, whichever is later.4Internal Revenue Service. How Long Should I Keep Records
Willful failure to keep required tax records is a federal misdemeanor carrying fines up to $25,000 for individuals or $100,000 for corporations, plus up to one year in prison.5Office of the Law Revision Counsel. 26 USC 7203 Willful Failure to File Return, Supply Information, or Pay Tax The more common consequence is quieter: deductions get disallowed during an audit because nothing supports them.
Employment and Payroll Records
The Fair Labor Standards Act splits recordkeeping into two tiers. Core payroll records, collective bargaining agreements, and sales and purchase records: three years from the date of last entry.6U.S. Department of Labor. Fact Sheet #21: Recordkeeping Requirements under the Fair Labor Standards Act (FLSA) Supplementary records — time cards, wage rate tables, work schedules, and order or billing records — two years.7eCFR. 29 CFR Part 516 – Records to Be Kept by Employers
Payroll records must include each employee’s full name, Social Security number, address, hours worked each day and week, pay rate, and total wages per pay period.6U.S. Department of Labor. Fact Sheet #21: Recordkeeping Requirements under the Fair Labor Standards Act (FLSA) When these records are missing during a wage-and-hour dispute, courts shift the burden to the employer, and the Department of Labor’s estimates of unpaid wages are presumed correct unless disproved.
Form I-9
Employers must keep a completed Form I-9 for every employee hired after November 6, 1986. The retention formula is three years after the hire date or one year after employment ends, whichever is later.8U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9 Short-tenured employees’ I-9s are kept three years from hire; long-tenured employees’ forms are kept one year past departure.
EEOC Hiring Records
Private employers must keep personnel and employment records, including applications, resumes, and hiring decisions for candidates not selected, for at least one year from the date the record was made or the personnel action occurred, whichever is later. Educational institutions and state and local government employers have a two-year requirement.9U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602 If a discrimination charge is filed, all records related to that charge must be preserved until the matter is fully resolved, regardless of normal retention.
Employee Benefits Records
ERISA imposes two separate retention duties on plan sponsors. Section 107 requires records supporting plan filings — copies of the annual Form 5500, nondiscrimination test results, employee communications, and financial reports — to be kept at least six years from the filing date.10U.S. Department of Labor. Recordkeeping in the Electronic Age
Section 209 is open-ended. Employers must maintain records sufficient to determine benefits due or potentially due to each employee, with no expiration. Because a former employee may file a claim years or decades after leaving, these records effectively need to be kept indefinitely.11U.S. Department of Labor. Recordkeeping in the Electronic Age – ERISA Advisory Council Written Statement A workable rule is to hold benefit determination records for the life of the plan plus at least six years after termination.
Workplace Safety and Environmental Records
OSHA requires employers to keep injury and illness logs (the OSHA 300 Log, 301 Incident Reports, and the annual summary) for five years after the end of the calendar year the records cover. Within that five-year window, stored 300 Logs must be updated to reflect newly discovered injuries or reclassified illnesses.12Occupational Safety and Health Administration. Retention and Updating
Employee medical records and exposure records run much longer. Medical records must be preserved for the duration of employment plus 30 years. Exposure records — documentation of workplace chemical, noise, or radiation exposure — must be kept at least 30 years on their own.13Occupational Safety and Health Administration. 1910.1020 – Access to Employee Exposure and Medical Records Occupational disease often surfaces decades after exposure, which is why these are among the longest retention periods in federal law. Employees who worked less than one year are an exception: their medical records don’t require long-term retention as long as the records are provided to the employee at termination.
Businesses generating hazardous waste must keep signed hazardous waste manifests for at least three years from the date the waste was accepted by the initial transporter. Biennial reports, exception reports, and records supporting hazardous waste determinations share the same three-year minimum. Any unresolved EPA enforcement action automatically extends every one of these periods until the matter is settled.14U.S. Environmental Protection Agency. Hazardous Waste Generator Regulations Compendium Volume 8 Recordkeeping and Reporting
Records Kept Permanently
Some documents define the legal existence and ownership structure of the business itself, and they have no expiration. Articles of incorporation, corporate bylaws, property deeds, and finalized board meeting minutes should be kept permanently. They prove the entity was lawfully formed, establish ownership of major assets, and provide the authoritative record of governance decisions that may be questioned decades later.
Annual financial statements, stock transfer records, and documents related to mergers, acquisitions, or major restructurings also belong in permanent storage. Reconstructing a stock issuance from 20 years ago or replacing a lost property deed is expensive at best and often impossible.
Electronic Storage Standards
Most agencies accept electronic records, but a digital copy has to meet specific conditions to stand in for a paper original. IRS Revenue Procedure 97-22, still in effect, requires an electronic storage system to produce a complete and accurate image of the original document, index files for quick retrieval during an audit, and prevent unauthorized alteration or deletion for the entire retention period. A 2023 Federal Register notice confirmed no changes to these requirements.15Federal Register. Proposed Collection Comment Request for Revenue Procedure 97-22
The E-SIGN Act sets broader criteria that apply across federal retention requirements. The electronic record must accurately reflect the original, remain accessible to everyone legally entitled to it for the full required period, and be reproducible in a form suitable for later reference by printing, transmission, or display.16Office of the Law Revision Counsel. Electronic Signatures in Global and National Commerce Act A record that can’t be accurately reproduced can be denied legal effect entirely.
Scanning alone isn’t enough. The system has to preserve legibility, prevent tampering, index files for search, and keep older formats compatible with current software. If your archives sit on legacy tape backups or obsolete disc formats, migrate them before an audit reveals they’re unreadable.
Legal Holds Override Your Schedule
A retention schedule tells you the minimum time to keep records. A legal hold tells you to stop destroying them, even after the retention period has expired. The duty attaches when your business knows or reasonably should know that documents are relevant to current or anticipated litigation.17United States District Court for the District of Nebraska. Litigation Hold: The Top Ten Things Every In-House Counsel Should Know A formal lawsuit isn’t required. A demand letter, a regulatory investigation, or an internal harassment complaint can be enough.
Destroying records after this duty attaches carries serious consequences under Federal Rule of Civil Procedure 37. If electronically stored information that should have been preserved is lost because a party failed to take reasonable steps, the court can order remedial measures; if the destruction was intentional, the court can instruct the jury to presume the lost information was unfavorable, dismiss the case, or enter a default judgment.18Legal Information Institute. Federal Rules of Civil Procedure Rule 37
Every business needs a documented process for issuing legal holds, identifying affected custodians and systems, and suspending routine destruction. This is where mistakes are most expensive. A company can follow its retention policy perfectly for years and still face sanctions if it keeps shredding once litigation becomes foreseeable.
Disposing of Records When the Period Expires
Once a record has passed its retention period and no legal hold applies, proper disposal matters as much as proper storage. Simple deletion of digital files leaves data recoverable with widely available forensic tools. Permanent wiping with certified data-destruction software, degaussing, or physical destruction of the media is the standard.
Cross-cut shredding handles paper. Businesses that handle consumer information — credit reports, background checks, or records derived from consumer reports — face additional obligations under the FACTA Disposal Rule, which requires reasonable measures to protect against unauthorized access during disposal. Examples in the rule include shredding paper so it can’t practicably be read or reconstructed, destroying electronic media so data is unrecoverable, and conducting due diligence on any third-party shredding vendor.19eCFR. Disposal of Consumer Report Information and Records
Due diligence on a destruction vendor means more than signing a contract. The rule contemplates reviewing independent audits, obtaining references, requiring industry certification, and evaluating information security policies.19eCFR. Disposal of Consumer Report Information and Records A certificate of destruction from the vendor documents the date, method, and scope of disposal. Keep these certificates permanently. They’re the proof of compliance if questions come up years later about what happened to specific records.
The most common failure in destruction isn’t technique. It’s inconsistency. Selective or ad hoc destruction looks suspicious in litigation and undermines the presumption that disposal was routine. A written retention schedule with documented, periodic destruction cycles shows that records were disposed of as ordinary business operations, not as evidence management.