Most private employers should keep background checks on file for at least five years, though the exact minimum depends on which laws apply and what happened during hiring. There is no single federal retention period. The Fair Credit Reporting Act sets a five-year outer statute of limitations, the EEOC requires a one-year floor for personnel records, and federal contractors face separate two- and three-year rules. Five years is the practical baseline because it’s long enough to cover the FCRA claim window that most often drives litigation.
Why Five Years Is the Working Minimum
The FCRA governs background checks obtained through a consumer reporting agency, and it doesn’t name a specific retention period. What it does set is a statute of limitations: an FCRA claim must be filed within two years of when the plaintiff discovered the violation, or five years from the date the violation occurred, whichever comes first.1Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions
That five-year outer limit is why experienced HR teams treat five years as the floor. Destroy the report at two years, and a claim surfacing in year four leaves you with nothing to show that you obtained consent, provided the required disclosure, or followed the adverse action process. The report and its paperwork are the defense.
This matters most when the hiring decision was a denial. If you turned an applicant down based on the report, the FCRA required you to send a pre-adverse action notice with a copy of the report and a summary of rights, and then a final adverse action notice identifying the consumer reporting agency and the applicant’s right to dispute.2Federal Trade Commission. Using Consumer Reports: What Employers Need to Know Keep copies of both notices, with proof of when they were sent.
The EEOC One-Year Floor and What Extends It
Title VII, the ADA, and GINA feed into one set of EEOC recordkeeping rules. Private employers must keep all personnel and employment records — including applications and hiring documents — for at least one year from the date the record was made or the personnel action was taken, whichever is later. For involuntary terminations, the clock runs one year from the termination date.3U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
One year is only the baseline. Once a discrimination charge is filed, you must preserve all records related to the charge until final disposition, which can stretch into years if the case moves to federal court. That obligation isn’t limited to the charging party’s records — you also have to keep records for other employees and applicants who held or sought similar positions.4U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements – Section: When a Charge Has Been Filed
A worker has 180 days from the alleged discrimination to file a charge, extended to 300 days where a state or local agency enforces a similar law.5U.S. Equal Employment Opportunity Commission. Time Limits for Filing a Charge A charge can still land in your mailbox after the one-year retention period expires. That’s another reason to treat the EEOC number as a floor rather than a target.
Age Discrimination and Medical Records
The ADEA has its own rules under 29 CFR Part 1627: payroll records for three years, records on which employment decisions are based (applications, test results) for one year. The 300-day extended filing deadline for ADEA charges applies only when a state law prohibits age discrimination and a state agency enforces it; a local law alone won’t extend it.5U.S. Equal Employment Opportunity Commission. Time Limits for Filing a Charge
If your background check pulls in medical information after a conditional job offer, the ADA imposes a storage rule that runs alongside retention. Medical information must be kept on separate forms, in separate medical files, and treated as a confidential medical record accessible only to supervisors who need to know about restrictions or accommodations, first-aid personnel responding to an emergency, and government officials investigating compliance.6Office of the Law Revision Counsel. 42 USC 12112 – Discrimination Mixing medical records into the general personnel file is a violation regardless of how long you keep them.
Federal Contractor Rules
If you hold federal contracts, OFCCP adds a layer. Contractors with 150 or more employees and a contract worth at least $150,000 must keep all personnel and employment records for two years from the date of the record or personnel action, whichever is later. Smaller contractors — fewer than 150 employees or contracts below the $150,000 threshold — must retain records for at least one year.7GovInfo. 41 CFR 60-1.12 – Record Retention
Separately, the Federal Acquisition Regulation requires contractors to make records available for contract administration and audit purposes for three years after final payment on the contract.8Acquisition.GOV. Subpart 4.7 – Contractor Records Retention The clock starts at the end of the contractor’s fiscal year in which the final cost entry was made. If a background check ties into a specific contract, the longer FAR window may control.
A Note on Form I-9
Form I-9 isn’t a background check, but employers often file it alongside screening paperwork, so the retention rule is worth naming to avoid confusion. Keep each I-9 for three years after the hire date or one year after employment ends, whichever is later.9USCIS. 10.0 Retaining Form I-9 The FCRA and EEOC retention analysis above does not govern I-9s, and vice versa.
State Law Can Push the Number Higher
State requirements add another variable. Depending on where you operate, state law may require you to hold employment records for two, three, or seven years. Some states have specific rules for background check authorizations; others fold them into general personnel-record retention. About half the states and Washington, D.C. have also enacted ban-the-box or fair chance hiring laws that restrict when in the process a criminal background check can be pulled, which can create documentation obligations about when and why a check was run.
When federal and state periods conflict, follow the longer one. Multi-state employers usually find it simplest to identify the longest applicable period across every jurisdiction they operate in and apply it company-wide.
What Belongs in the File
A retention policy has to cover every document that touched the screening, not just the report itself. At minimum:
- The signed authorization form and the standalone FCRA disclosure.
- The background check report — criminal history, credit reports, driving records, or any other results from the consumer reporting agency.
- The pre-adverse action letter (with the report copy and summary of rights) and the final adverse action notice, plus delivery confirmation showing when each was sent.
- Internal notes showing how the report factored into the hiring decision, including any individualized assessment if criminal history was considered.
- Correspondence with the applicant about results, disputes, or additional information they provided.
The authorization and disclosure forms carry as much weight as the report. If an applicant later claims they never consented, that signed disclosure is what stands between you and an FCRA suit. Employers using electronic signatures should confirm their system can reproduce the signed document years later.
Secure Storage and Proper Disposal
Background check reports contain Social Security numbers, dates of birth, criminal history, and sometimes financial data. Storing them carelessly creates liability that outlives the retention period. Paper records belong in locked cabinets with access limited to people who need it. Digital files should be encrypted and access-logged. ADA medical records, as noted, must sit in a separate confidential file.
When records reach the end of their retention period, the FTC’s Disposal Rule requires reasonable measures to prevent unauthorized access during destruction. Paper must be burned, pulverized, or shredded so the information can’t be read or reconstructed. Electronic media must be destroyed or erased so data can’t be recovered. If you use a disposal vendor, the rule expects due diligence: checking references, reviewing security policies, or requiring certification by a recognized trade association.10eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information The obligation applies to anyone who possesses consumer report information for a business purpose, not just the employer who ordered the report, so staffing agencies, HR consultants, and third-party administrators share the duty.11Federal Trade Commission. Disposal of Consumer Report Information and Records
What Happens If You Destroy Records Too Early
Two problems follow. The obvious one is failing an EEOC investigation or compliance audit: if the agency asks for documentation and you can’t produce it, you can’t show the process was lawful.
The less obvious one is adverse inference. In discrimination cases, when records that should exist are missing, a judge can instruct the jury to assume the missing records would have supported the employee’s claim. The practical effect is that the employer has to prove the process wasn’t discriminatory without the documents that would have done it.
Holding records forever isn’t the answer either. Every extra year of retention is another year of exposure to breaches, identity theft claims, and state privacy law violations. The goal is a written policy, consistently applied: retain for the required period, then destroy properly.
A Practical Retention Schedule
Given the overlapping federal timelines, a workable framework for most private employers looks like this:
- Background check reports and authorization forms: five years from the hiring decision. This covers the FCRA outer statute of limitations and clears the EEOC one-year baseline.
- Adverse action documentation: five years minimum, longer if the applicant disputed the decision or filed a complaint.
- Form I-9: three years from the hire date or one year after employment ends, whichever is later.
- ADA medical records: same period as other personnel records, stored in a separate confidential file at all times.
- Federal contractor records: two years from the record date or personnel action for larger contractors, or three years after final contract payment under FAR, whichever is longer.
If a discrimination charge or lawsuit is pending, override all of these and keep everything until the matter is fully resolved. Destruction during active litigation invites sanctions far worse than any recordkeeping fine. Whatever schedule you adopt, put it in writing and apply it consistently. Selective enforcement of a retention policy can itself become evidence of discriminatory intent.