Employee recordkeeping requirements come from several federal agencies with overlapping rules: employers must keep specific hiring, eligibility, payroll, tax, and safety records for periods ranging from one year to five years, store medical information separately from general personnel files, and dispose of records securely once retention expires. Getting any piece wrong can produce per-form fines, back-pay liability, or an inability to defend an audit or lawsuit.
Which Records Federal Law Requires
Hiring and Eligibility Documents
Every new hire must complete Section 1 of Form I-9 no later than their first day of work. The employer completes Section 2 within three business days of the start date, or on the first day if the person is hired for fewer than three business days.1U.S. Citizenship and Immigration Services. Form I-9 – Employment Eligibility Verification The form verifies identity and work authorization using documents from an approved list.
Each employee also completes Form W-4, which reports filing status, adjustments for multiple jobs, credits, deductions, and any additional withholding. The employer uses it to calculate federal income tax withholding on every paycheck.2Internal Revenue Service. Topic no. 753, Form W-4, Employees Withholding Certificate Keep the current W-4 on file for every active employee and retain it after they leave.
Federal law also requires reporting every new and rehired employee to the state’s Directory of New Hires within 20 days of the start date, though some states set shorter deadlines. The report includes the employee’s name, address, and Social Security number; the date of hire; and the employer’s business name, address, and federal Employer Identification Number. Multistate employers can register with HHS and submit all reports electronically to one designated state, no more than twice a month.3Administration for Children and Families. New Hire Reporting
Personnel and Performance Records
Federal anti-discrimination law requires records related to hiring, promotion, demotion, transfer, layoff, termination, pay rates, and other terms of employment.4U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602 Performance evaluations and disciplinary write-ups fall inside this category. Each entry should carry the date, the supervisor involved, and the specific outcome or warning. This paper trail is what defends the employer if a former worker alleges that a termination or demotion was discriminatory. Without it, the argument rests on memory.
Payroll and Wage Records
The Fair Labor Standards Act requires specific payroll data for every covered, non-exempt worker: the time and day the workweek begins, hours worked each day, total hours for the workweek, the regular hourly pay rate, total straight-time earnings, and total overtime earnings. Non-exempt employees who work more than 40 hours in a week must be paid at least one and a half times their regular rate for the extra hours.5U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements under the Fair Labor Standards Act
Deductions for taxes, insurance premiums, and retirement contributions should be itemized so net pay for each period is easy to verify. In a wage-and-hour dispute, the burden falls on the employer to show every dollar withheld was authorized.
Employment Tax Records
The IRS requires records showing the amounts and dates of all wage payments, the Employer Identification Number, and the taxes withheld and deposited.6Internal Revenue Service. Employment Tax Recordkeeping
Workplace Safety Records
Most employers with more than 10 employees must maintain OSHA injury and illness logs. The core forms are the OSHA 300 Log, a running record of work-related injuries and illnesses; the 300A Summary, an annual summary posted for employees to see; and the 301 Incident Report, with details on each individual case.
Employers in designated high-hazard industries with 100 or more employees also submit Forms 300, 300A, and 301 electronically through OSHA’s Injury Tracking Application. The annual electronic submission deadline is typically in early March. The 300A Summary must be physically posted in a visible workplace location from February 1 through April 30 each year.
How Long to Keep Each Record
Retention periods vary by agency and record type. Mixing them up is one of the most common compliance mistakes.
- One year. Personnel and employment records, including application materials, hiring records, and documents related to promotion, demotion, transfer, or termination, must be kept for one year from the date the record was made or the action was taken, whichever is later. For involuntary terminations, the clock runs one year from the date of termination.4U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
- Two years. Wage computation records such as time cards, work schedules, and wage rate tables, under the FLSA.5U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements under the Fair Labor Standards Act
- Three years. Payroll records, including total compensation and pay dates, under the FLSA.5U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements under the Fair Labor Standards Act
- Three years after hire, or one year after termination, whichever is later. Form I-9.7U.S. Citizenship and Immigration Services. Retention and Storage
- Four years. Employment tax records, kept for at least four years after filing the fourth-quarter return for the year.6Internal Revenue Service. Employment Tax Recordkeeping
- Five years. OSHA injury and illness records (Forms 300, 300A, and 301), kept for five years following the year they cover.
Some states impose longer retention periods for wage or personnel records, so check the state labor department’s requirements. Where a state period is longer than the federal one, the state period controls.
Storing Employee Records
Medical Information Stays Separate
The ADA requires that any medical information about an applicant or employee be stored on separate forms, in a separate medical file, and treated as a confidential medical record. Genetic information covered by GINA is handled the same way.8Job Accommodation Network. Recordkeeping Requirements and the ADA Medical documents cannot live in the general personnel file. Physical offices should use a distinct locked cabinet; digital systems need restricted folders with permissions limited to authorized HR staff who have a legitimate business reason to access the information.
Physical and Digital Safeguards
Physical files belong in a secure environment: a locked room, fire-resistant cabinets, or both. For digital records, encryption and role-based access controls are the baseline. Each authorized user should have a unique login, and the system should log every access event. Audit logs matter if you ever need to prove who viewed a file and when. Reviewing access permissions on a schedule catches the common problem of former managers or transferred employees keeping access they no longer need.
Employee Access to Their Own Files
No single federal law gives employees a blanket right to inspect their personnel files. About half of states have their own access laws, and the requirements vary widely. Some mandate that a copy be provided within a few business days of a written request; others allow inspection only during normal business hours at a designated location.
Penalties for Recordkeeping Failures
Recordkeeping fines add up quickly because they’re often assessed per employee or per form rather than as a single lump sum.
For I-9 violations, ICE’s March 2026 guidance reclassified many previously correctable paperwork errors as substantive violations carrying immediate monetary penalties. Missing signatures, incomplete fields, and late completion now expose employers to fines without a grace period. Civil penalties for I-9 paperwork violations are assessed per form, so 50 improperly completed forms produce 50 separate penalty calculations.
The IRS can impose penalties for failing to file employment tax returns, underreporting wages, or failing to deposit withheld taxes on time. The four-year retention requirement exists because the IRS can audit employment taxes within that window.6Internal Revenue Service. Employment Tax Recordkeeping If records aren’t produced during an audit, the IRS may reconstruct the tax liability using its own estimates.
OSHA posting and recordkeeping violations can carry penalties of up to $16,550 per violation. Penalties are calculated per violation rather than per inspection, so a single visit can generate multiple citations if several requirements are out of compliance at once.
Under the FLSA, failing to maintain required wage and hour records shifts the burden of proof in any wage dispute. If an employee claims unpaid overtime and the employer can’t produce time records, courts will typically accept the employee’s reasonable estimate of hours worked.
Disposing of Records After Retention Expires
Once a retention period ends, keeping records longer than necessary creates its own risk. Old files with Social Security numbers, addresses, and bank details are a liability if they’re breached.
Paper documents need cross-cut shredding thorough enough that the original information can’t be reconstructed. Professional shredding services typically provide certificates of destruction, worth keeping as proof of proper disposal. For digital records, deleting a file isn’t enough, because standard deletion only removes the directory entry while leaving the data recoverable. Overwriting tools that write random data across the storage area multiple times are the minimum standard. If hardware is being retired entirely, physical destruction of the drive is the most reliable option.
Keep a disposal log recording what was destroyed, the date, the method used, and who authorized the destruction. That log is the evidence of compliance if anyone later asks why a particular record no longer exists.