How long you need to keep complaint records depends on your industry, but a useful baseline is three to seven years. Healthcare organizations face a six-year federal minimum under HIPAA. Financial firms retain written customer complaints for four to six years depending on the regulator. Employment discrimination complaints run on a much shorter one-year clock that stretches indefinitely once a charge is filed. And any complaint tied to actual or reasonably anticipated litigation must be preserved until that matter fully resolves, regardless of what the standard schedule says.
What Counts as a Complaint Record
A complaint record is more than the original grievance. It covers every document generated across the complaint’s life: the initial report (phone, email, letter, or online form), internal investigation notes, communications with the person who complained, and records of the resolution, whether a refund, replacement, or policy change.
Regulated industries push the definition further. Financial firms must capture the written complaint together with any action taken in response.1FINRA.org. FINRA Rule 4513 – Records of Written Customer Complaints Manufacturers handling safety reports keep the raw data, follow-up correspondence, and any analysis of whether the complaint was valid. Complaints your organization receives through social media channels it operates may qualify as formal complaints under the same rules that govern traditional channels.
The Default Baseline When No Specific Rule Applies
If no industry-specific regulation reaches your complaint records, three to seven years is a defensible baseline. That range tracks the most common statutes of limitations for contract and tort claims, which generally fall between two and six years. Holding records slightly past the longest applicable limitation period gives you a buffer if a dispute surfaces near the deadline.
Businesses selling long-lived products or working in construction may also face statutes of repose, which set an absolute outer boundary measured from the defendant’s last relevant action and can stretch to ten years or more. If a repose period applies to your work, your retention schedule needs to reach at least that far.
Healthcare Complaint Records
HIPAA’s privacy rule requires covered entities to retain compliance documentation for six years from the date the record was created or last took effect, whichever is later.2eCFR. 45 CFR 164.530 – Administrative Requirements That covers policies, written communications, and documentation of any actions required under the privacy rule. Patient complaints that trigger privacy-related investigations sit squarely inside this requirement.
The FDA imposes its own timelines for safety records. Companies named on dietary supplement or nonprescription drug labels must keep records of all adverse event reports for six years, whether the event was serious or not.3Reginfo.gov. Adverse Event Reporting and Recordkeeping for Dietary Supplements as Required by the Dietary Supplement and Nonprescription Drug Consumer Protection Act For prescription drugs marketed without an approved new drug application, the retention period jumps to ten years and covers all adverse drug experience records, including raw data and related correspondence.4eCFR. 21 CFR 310.305 – Records and Reports Concerning Adverse Drug Experiences on Marketed Prescription Drugs
State medical records laws often add another layer. Many states require physicians and hospitals to keep patient records for six years or longer from the last visit, with extended periods for pediatric and obstetric records. When a patient complaint becomes part of the medical record, the state’s longer retention period can effectively override the federal floor.
Financial Services Complaint Records
Financial firms operate under overlapping requirements, and timelines vary by product and regulator.
FINRA and MSRB
FINRA requires broker-dealers to preserve written customer complaint records for at least four years.1FINRA.org. FINRA Rule 4513 – Records of Written Customer Complaints If the complaint involves municipal securities, retention extends to six years under MSRB Rule G-9.5MSRB. Rule G-9 – Preservation of Records Each file must include the original complaint and any action the firm took, accessible at or promptly available to the relevant supervisory office.
SEC and Investment Advisers
Registered investment advisers must keep most required records for at least five years from the end of the fiscal year in which the last entry was made, with the first two years in an accessible office location.6eCFR. 17 CFR 275.204-2 – Books and Records To Be Maintained by Investment Advisers Communications and advertising records follow the same five-year timeline.
Credit and Mortgage Complaints
Under the Equal Credit Opportunity Act’s implementing regulation, creditors must retain records related to credit applications for 25 months after notifying an applicant of the decision. For business credit, the default period is 12 months, though large businesses receiving adverse action may trigger a shorter 60-day window that extends to 12 months if the applicant requests an explanation in writing. If a creditor is under investigation or facing an enforcement action, retention extends until final disposition regardless of the standard timeline.7eCFR. 12 CFR 1002.12 – Record Retention
For mortgage lending, Closing Disclosures and all related documents under the integrated TILA-RESPA rules must be retained for five years after consummation of the loan.8Consumer Financial Protection Bureau. 12 CFR 1026.25 – Record Retention Any complaint tied to a mortgage transaction should be kept at least that long.
Consumer Products and Telecommunications
The Consumer Product Safety Commission has pursued recordkeeping rules that would require manufacturers, importers, private labelers, and distributors to maintain consumer product safety complaints. A revised proposal set retention at three years from the date each complaint was received.9CPSC.gov. Consumer Product Safety Complaints Under Consumer Product Safety Act Proposed Rules for Recordkeeping Covered records include any communication about a death, injury, illness, or potential safety hazard tied to a consumer product.
In telecommunications, companies covered by the Twenty-First Century Communications and Video Accessibility Act must keep records documenting their efforts to meet accessibility requirements for at least two years after a product or service is no longer manufactured or offered.10Federal Register. Implementing the Provisions of the Communications Act of 1934, as Enacted by the Twenty-First Century Communications and Video Accessibility Act of 2010
Workplace and Employment Complaints
Employers face two main federal frameworks for workplace complaint records, and both can apply at once.
OSHA requires businesses to keep injury and illness records, including the OSHA 300 Log, annual summaries, and 301 Incident Report forms, for five years following the end of the calendar year the records cover. During that five-year window, the 300 Logs must be updated if new recordable injuries surface or previously recorded cases are reclassified. The annual summaries and individual incident reports do not require updating.11Occupational Safety and Health Administration. 1904.33 – Retention and Updating
For discrimination complaints under Title VII, the ADA, or GINA, the EEOC requires employers to retain all personnel and employment records for at least one year from the date the record was made or the personnel action occurred, whichever is later. For involuntary terminations, the one-year clock runs from the termination date. Once a formal discrimination charge is filed, the obligation escalates: the employer must preserve all records related to the charge until final disposition, meaning either the expiration of the period for the complainant to file a lawsuit or the conclusion of any litigation that follows.12U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
When the Clock Gets Extended
Standard retention periods are a floor, not a ceiling. Several situations push the actual requirement well past the baseline.
Litigation Holds
The moment your organization reasonably anticipates a lawsuit, you must suspend any routine document destruction that could affect relevant records. This obligation kicks in before anyone files suit. A demand letter, notice of a serious injury tied to your product, or word of a regulatory investigation can all trigger the duty. The hold stays in place until the matter is resolved through settlement, judgment, dismissal with prejudice, or expiration of the relevant statute of limitations.
This is where most organizations get into trouble. An employee follows the normal retention schedule and shreds files that are technically past their expiration date but directly relevant to a looming lawsuit. Even accidental destruction of that kind can produce serious court sanctions.
Regulatory Investigations
Several regulations explicitly extend retention when you’re under investigation. The CFPB’s credit application rules require records to be kept until final disposition of any enforcement proceeding, even if the standard 25-month period has long passed.7eCFR. 12 CFR 1002.12 – Record Retention The general principle: if a regulator is looking at your records, do not destroy them.
Contractual and Internal Requirements
Business contracts sometimes specify retention periods longer than what the law requires. A vendor agreement might obligate you to keep complaint records for seven or ten years. Internal policies may also set a longer schedule for risk management or quality improvement purposes. When a contract or policy exceeds the legal minimum, the longer period controls.
Privacy Deletion Requests Versus Retention Duties
Data privacy laws create a tension every retention policy has to resolve. The GDPR’s right to erasure lets individuals request deletion of their personal data, but the regulation carves out an exception where retention is necessary to comply with a legal obligation.13General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten) The California Consumer Privacy Act follows the same structure, granting consumers the right to request deletion while exempting data the business must retain under other legal obligations.
In practice, you can and should honor deletion requests for complaint data that has passed its mandatory retention period. If a complaint record is still within its required retention window, or under a litigation hold, the legal obligation to keep it overrides the deletion request. Document why you’re retaining the data, so you can show the basis if challenged. Once the retention obligation expires and no other legal reason to keep the data exists, process the deletion.
What Destroying Records Too Early Actually Costs
Premature destruction of complaint records can produce consequences far worse than whatever the records themselves contained.
In litigation, courts can impose spoliation sanctions when a party destroys evidence it had a duty to preserve. The most common sanction is an adverse inference instruction, where the judge tells the jury it may assume the destroyed records would have been unfavorable to the party that destroyed them. Courts have also imposed monetary fines, prohibited the destroying party from presenting evidence on the affected issue, and in extreme cases dismissed claims or entered default judgment. Severity typically scales with fault, from negligent loss to intentional destruction.
Regulatory penalties add another layer. The FTC can impose civil penalties exceeding $50,000 per violation for improper handling or disposal of consumer information, adjusted upward for inflation each year. FINRA, the SEC, and OSHA each have their own enforcement tools, from fines to license suspension.
There’s also a defensive cost. Destroyed complaint records eliminate your ability to demonstrate due diligence. If a customer sues over a product defect and you can’t produce a complaint history showing you investigated and resolved similar issues, you’ve lost one of your strongest defensive tools.
Building a Retention Schedule You Can Actually Follow
Rather than applying one retention period across the board, identify which regulations apply to each type of complaint your organization receives, then set retention at or above the applicable legal minimum for each category. A healthcare company handling both patient privacy complaints and employment grievances needs at least two timelines: six years for HIPAA-related records, one year (or until final disposition) for EEOC-related records.
Disposal method matters when the time comes. Physical documents containing personal information should be shredded or incinerated, not recycled. Electronic records need their own protocol: deleting a file doesn’t remove the data from the storage device. Sensitive digital records should be overwritten, or the storage media physically destroyed, depending on sensitivity and device type.
Put the schedule in writing, train the people who handle complaints on the applicable timelines, and build a review process that flags records approaching expiration. Include a mechanism to suspend normal disposal whenever litigation or a regulatory investigation is reasonably anticipated. The litigation hold is the most common failure point in records management, and it carries the most severe consequences.