Federal record retention requirements for employers run from one year for basic hiring paperwork to permanent for founding corporate documents, with most payroll, tax, and workplace records sitting between three and seven years. No single statute controls; the periods come from labor, tax, safety, immigration, environmental, benefits, and securities laws, and each has its own clock and its own starting event. The sections below organize the rules by record type so you can find what applies and calculate the correct disposal date.
Quick Reference by Record Type
- FLSA payroll records (names, hours, wages, deductions): 3 years
- Time cards, wage-rate tables, work schedules: 2 years
- EEO personnel and hiring records: 1 year from creation or personnel action
- Form I-9: 3 years after hire or 1 year after termination, whichever is later
- General income tax records: 3 years (longer in specific situations)
- Employment tax records: 4 years after the tax is due or paid
- OSHA 300, 300A, and 301 injury logs: 5 years after the calendar year
- Employee exposure records: 30 years
- Employee medical records tied to exposures: length of employment plus 30 years
- DOT drug and alcohol tests (most agencies): 1 year negative, 5 years positive
- HIPAA policies and required documentation: 6 years
- ERISA filings and supporting records: 6 years from filing
- Hazardous waste manifests: 3 years from acceptance by initial transporter
- Articles of incorporation, bylaws, board minutes, stock records: permanent
- SOX audit workpapers: 7 years from end of engagement
- Federal contract records: 3 years after final payment
The rest of this article explains each of those lines, the starting event that begins the clock, and the situations that extend the period.
Payroll and Wage Records
The Fair Labor Standards Act splits payroll records into two tiers. Primary payroll records get three years; the supporting documents behind them get two.1eCFR. 29 CFR Part 516 – Records to Be Kept by Employers
The three-year bucket covers employee names, hours worked each workday and workweek, pay rates, straight-time and overtime earnings, deductions, and total wages paid each pay period. Collective bargaining agreements, individual employment contracts used to calculate wages, and sales and purchase records tied to wage computations also belong here.
The two-year bucket covers time cards, daily start and stop records, wage-rate tables, piece-rate schedules, and work and time schedules. The two-year clock runs from the date of the last entry on the document.2U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements under the Fair Labor Standards Act
Hiring, EEO, and Immigration Records
EEO and Personnel Records
Under 29 CFR Part 1602, personnel and employment records must be kept for at least one year from the date the record was created or the date of the personnel action, whichever is later. Applications, resumes, interview notes, and records tied to hiring, promotion, demotion, transfer, or termination all sit in this bucket. For an involuntary termination, the one-year clock runs from the termination date.3U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
A discrimination charge stops the clock. Once the EEOC files a charge or brings a civil action, you must preserve every record relevant to the matter until final disposition, no matter how many years that takes.4eCFR. 29 CFR Part 1602 – Recordkeeping and Reporting Requirements Under Title VII, the ADA, GINA, and the PWFA
Form I-9
Every completed Form I-9 must be kept for three years after the date of hire or one year after the employee’s last day of work, whichever is later.5Office of the Law Revision Counsel. 8 USC 1324a – Unlawful Employment of Aliens A practical shortcut: for employees who worked less than two years, use the three-years-from-hire date. For employees who worked longer than two years, use the one-year-after-termination date. The rule applies to every hire regardless of citizenship, and paper and electronic forms are both acceptable.6USCIS. 10.0 Retaining Form I-9
Tax Records
Income Tax
The default is three years from the date the return was filed, matching the IRS’s standard assessment window.7Office of the Law Revision Counsel. 26 US Code 6501 – Limitations on Assessment and Collection If you file a refund claim, keep the records for three years from filing or two years from the date the tax was paid, whichever is later.8Internal Revenue Service. How Long Should I Keep Records
Three situations extend the default:
- Unreported income greater than 25% of gross income: keep records at least six years, because the IRS assessment window extends to six.
- Worthless securities or bad debt loss deductions: keep records seven years.
- Fraudulent returns or returns never filed: no statute of limitations, so keep records indefinitely.9Internal Revenue Service. Topic No. 305, Recordkeeping
Employment Tax
Payroll tax records get a longer floor: at least four years after the date the tax becomes due or is paid, whichever is later. Wages paid, tips reported, withholding amounts, employee names and addresses, and dates of employment all belong in this file.10Internal Revenue Service. Employment Tax Recordkeeping
Workplace Safety and Health
OSHA Injury and Illness Logs
Employers with more than ten employees in the prior calendar year must keep OSHA Forms 300, 300A, and 301 for five years after the end of the calendar year the records cover.11Occupational Safety and Health Administration. 29 CFR 1904.33 – Retention and Updating Employers with ten or fewer employees are partially exempt from routine logging but must still report fatalities, hospitalizations, amputations, and eye losses.12Occupational Safety and Health Administration. 29 CFR 1904.1 – Partial Exemption for Employers with 10 or Fewer Employees
Exposure and Medical Records
Records tied to employee exposure to hazardous chemicals or physical agents carry the longest retention periods in federal law. Employee exposure records must be kept for at least 30 years. Medical records connected to workplace exposures must be kept for the duration of employment plus 30 years. Occupational diseases such as mesothelioma or chronic beryllium disease can take decades to appear.13eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
Two narrow carve-outs apply. First-aid records for minor injuries treated on-site by non-physicians escape the 30-year rule if stored separately from the medical program files. Medical records for employees with less than one year of service can be handed to the employee at termination instead of retained.
DOT Drug and Alcohol Testing
For most DOT-regulated employers (FMCSA, FTA, FAA, PHMSA, and USCG), negative drug results must be kept one year and verified positives five years. The Federal Railroad Administration requires two years for negative results. For FAA-regulated pilots, even negative results must be kept five years.14U.S. Department of Transportation. Employer Record Keeping Requirements for Drug and Alcohol Testing Information
HIPAA Documentation
Covered entities and business associates must keep their security policies, procedures, and required assessments for six years from the date of creation or the date the document was last in effect, whichever is later.15eCFR. 45 CFR 164.316 – Policies and Procedures and Documentation Requirements Written security policies, risk assessments, access logs, training records, and business associate agreements all fall under this six-year rule.
ERISA and Benefits Records
ERISA imposes two overlapping duties. Section 107 requires plan administrators to keep records supporting annual filings for at least six years from the filing date. That includes Form 5500 and its schedules, nondiscrimination testing results, employee communications, financial reports, fidelity bond documentation, and corporate tax returns used to reconcile plan deductions.16U.S. Department of Labor. Recordkeeping in the Electronic Age
Section 209 goes further. Employers must maintain records sufficient to determine the benefits due or that may become due to each employee. That includes plan documents, amendments, summary plan descriptions, trust documents, census data, deferral elections, account records, and documentation for loans and distributions. Because a claim can arise as long as benefits could be owed, many plan sponsors retain these records until all benefits have been paid and the audit window has closed.
Hazardous Waste and Environmental Records
Under 40 CFR 262.40, generators must retain a signed copy of each hazardous waste manifest for at least three years from the date the waste was accepted by the initial transporter. Biennial reports and exception reports also carry a three-year retention from the report due date.17eCFR. 40 CFR 262.40 – Recordkeeping Facilities receiving hazardous waste keep records for three years from the date of delivery.18eCFR. 40 CFR 264.71 – Use of Manifest System
If the EPA opens an enforcement action, retention extends automatically until the matter concludes. Clean Air Act compliance monitoring records at affected sources must be kept for at least five years under specific emissions standards.19eCFR. 40 CFR 63.1259 – Recordkeeping Requirements
Corporate Governance and Audit Records
Some documents have no expiration date. Articles of incorporation, bylaws, board meeting minutes, shareholder agreements, stock certificates, and ownership transfer ledgers should be kept permanently. They establish the legal existence of the entity, prove decision-making authority, and resolve ownership questions in mergers, acquisitions, and litigation.
Public companies and their auditors face a separate seven-year rule under Section 802 of the Sarbanes-Oxley Act. Audit workpapers, memoranda, correspondence, and any documents containing conclusions, opinions, analyses, or financial data connected to an audit or review must be kept for seven years from the end of the audit engagement.20Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews Knowingly destroying records to obstruct a federal investigation carries up to 20 years in prison under 18 U.S.C. 1519.21Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations
Federal Contractor Records
FAR 4.703 sets the baseline for contractor records at three years after final payment on the contract. Financial and cost accounting records, indirect cost rate computations, and supporting documentation all fall under this rule.22Acquisition.GOV. FAR 4.703 – Policy
Three things can push the period longer:
- An individual contract clause specifying a longer retention; the contract terms override the FAR default.
- A late final indirect cost rate proposal, which extends retention by one day for each day the proposal is late.
- Electronic storage, which is allowed, but originals must be kept for at least one year after imaging so the digital copies can be validated.
Retention is calculated from the end of the contractor’s fiscal year in which the cost was charged or allocated to the government contract.23Acquisition.GOV. Subpart 4.7 – Contractor Records Retention
When Litigation Pauses the Clock
Every retention period above assumes normal operations. Once litigation is reasonably foreseeable, you must preserve all records that could be relevant, even those otherwise eligible for destruction. Routine disposal that would be compliant on a Tuesday can become spoliation on a Wednesday if a lawsuit was anticipated.
Federal Rule of Civil Procedure 37(e) governs lost electronically stored information. If information cannot be restored and the opposing party is prejudiced, the court can order corrective measures, though nothing more severe than necessary. If a party acted with intent to deprive the opponent of the evidence, the court can presume the lost information was unfavorable, instruct the jury on that presumption, or enter a default judgment or dismissal.
Metadata is part of what must be preserved. Courts have applied Rule 37(e) to embedded file properties, not just visible content, so stripping metadata during a litigation hold can trigger the same sanctions as deleting files. A workable hold process identifies custodians who possess relevant records, issues written preservation notices, and suspends automated deletion routines that would touch those records.
Building a Working Retention Schedule
Turn these rules into something usable by recording four things for each record type: the record itself (for example, “hazardous waste manifests” or “Form I-9”), the governing law or regulation, the required retention period, and the triggering event that starts the clock.
Triggering events are where most schedules go wrong. The same record can have a different start date depending on which regulation controls. OSHA injury logs run from the end of the calendar year. Employment tax records run from the date the tax was due or paid. ERISA filing records run from the date Form 5500 was filed. I-9 forms run from the later of hire plus three years or termination plus one year. Defaulting to “date created” for everything means either destroying records too early or holding them years longer than the law requires.
When a record reaches the end of its period and no litigation hold applies, destroy it through a documented process. Cross-cut shred physical documents; permanently delete electronic files using methods that overwrite the storage. Generate a certificate of destruction noting the record type, date, and method. Those certificates are how you prove a compliant disposal process if a regulator or auditor later asks why a particular document no longer exists.