How Long to Keep Business Records: Retention Rules by Category

Most business records should be kept for at least three years, but how long to keep business records depends on the record type: tax documents run three to seven years (sometimes indefinitely), payroll records four years, employee benefit plan records six, OSHA exposure records the length of employment plus thirty, and formation and ownership documents for the life of the company. The three-year figure is a floor built around the IRS’s general audit window. Several common situations push it further out.

Federal Tax Records

Federal law requires anyone liable for tax to keep records that support what appears on their returns.1Office of the Law Revision Counsel. 26 USC 6001 – Notice or Regulations Requiring Records, Statements, and Special Returns The retention period tracks the IRS’s statute of limitations, and the clock changes depending on what happened with the return.2Internal Revenue Service. How Long Should I Keep Records?

The documents covered include invoices, bank and credit card statements, receipts for business expenses, and anything else used to calculate income or support a deduction. For Form 1120 corporate returns, the IRS expects records for each item of income, deduction, or credit to be retained three years from when the return is due or filed, whichever is later.6Internal Revenue Service. 2025 Instructions for Form 1120 – US Corporation Income Tax Return

Employment Tax Records

Payroll tax records have their own rule: at least four years after the tax becomes due or is paid, whichever is later.2Internal Revenue Service. How Long Should I Keep Records? That covers W-2 copies, Form 941 quarterly returns, wage records, and documentation of tips reported by employees.

Employment and Personnel Records

Several agencies impose overlapping rules on employee-related documents, and each has its own clock.

Payroll Records Under the FLSA

Fair Labor Standards Act regulations require employers to preserve payroll records for at least three years from the last date of entry, including employee names, Social Security numbers, hours worked each week, and total wages paid.7eCFR. 29 CFR 516.5 – Records to Be Preserved 3 Years

Form I-9

Each employee’s Form I-9 must be kept for three years after the date of hire or one year after employment ends, whichever is later.8U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9 Storing I-9s separately from personnel files makes it easier to produce them during an immigration inspection.

Personnel and Hiring Records

The EEOC requires private employers to keep personnel records — job applications, resumes, performance evaluations, and documents tied to hiring, promotion, or termination — for one year from the date of the record or the personnel action, whichever is later. When an employee is involuntarily terminated, keep that person’s records for one year from the termination date.9U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602

FMLA Leave Records

Employers covered by the Family and Medical Leave Act must keep leave-related records for at least three years. That includes leave dates, copies of written leave requests, and copies of all written notices given to employees about their leave rights.10eCFR. 29 CFR 825.500 – Recordkeeping Requirements

Employee Benefit Plan Records

If your business sponsors a retirement plan, health plan, or other employee benefit plan, ERISA requires records supporting each plan filing to be kept for at least six years after the filing date. That includes plan documents, financial statements, vouchers, and any worksheets used to prepare required reports.11Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records The six-year period runs even if a simplified reporting exemption meant no report was actually filed; the clock starts from when it would have been due.

Workplace Safety Records

OSHA uses two very different timelines depending on the kind of safety record.

Injury and illness records — the OSHA 300 Log, the annual 300A summary, and the individual Form 301 incident reports — must be kept for five years following the end of the calendar year they cover. During that window, you also have to update the 300 Log to reflect changes in the status of previously recorded injuries.12Occupational Safety and Health Administration. 1904.33 – Retention and Updating

Medical and exposure records for employees who work with toxic substances or harmful physical agents run much longer: the duration of employment plus 30 years. Exposure monitoring records must also be kept for at least 30 years. A narrow exception applies when an employee worked less than one year — in that case, you may give the records to the employee at termination rather than retaining them.13Occupational Safety and Health Administration. 1910.1020 – Access to Employee Exposure and Medical Records

Property and Asset Records

Records for business property — real estate, vehicles, machinery, equipment — follow the underlying tax rules. Keep the documentation for as long as you own the asset, then for the applicable limitation period covering the tax year you dispose of it.2Internal Revenue Service. How Long Should I Keep Records? In most cases that means ownership plus three years, though it can stretch to six or seven.

Keep the purchase price, closing costs, titles, deeds, and bills of sale. Invoices for capital improvements matter just as much, because they adjust the property’s tax basis and therefore your gain or loss when you sell.

Contracts and Insurance Policies

No single federal law sets a retention period for expired contracts. The practical benchmark is the statute of limitations for a breach-of-contract claim in your state, which ranges from three years to 15 years or more depending on the jurisdiction. Seven years after expiration is a common conservative default. Contracts involving real property, intellectual property licenses, or long-term leases may warrant longer retention.

Expired insurance policies deserve their own treatment. Occurrence-based liability coverage — common in general and professional liability — can respond to claims filed years after the policy period, as long as the underlying event happened while the policy was in force. Keep declaration pages, endorsements, and certificates of insurance at least as long as someone could bring a claim. In industries with long-tail exposure like construction or environmental services, keeping expired policies permanently is the safer approach.

Records to Keep Permanently

Some documents form the legal foundation of the business and should be retained as long as the entity exists:

  • Formation documents, including articles of incorporation, certificates of organization, bylaws, and LLC operating agreements. These prove the company’s authority to enter contracts, open bank accounts, and operate in specific jurisdictions.
  • Ownership records, including partnership agreements, stock certificates, membership interest records, and documentation of every ownership transfer. These establish who holds voting rights and financial interests.
  • Meeting minutes from board and annual shareholder or member meetings. A complete set demonstrates that the business observed corporate formalities, which helps protect owners from personal liability for the entity’s debts.

Store these in a secure, fireproof location, or in a combination of physical and encrypted digital storage, so they remain accessible for the life of the business.

Electronic Storage

Electronic records are valid for IRS purposes if your storage system meets the agency’s standards. Under Revenue Procedure 97-22, the system must produce accurate, complete transfers of the original documents and include controls that prevent unauthorized changes, deletions, or deterioration.14Internal Revenue Service. Guidance for Taxpayers Maintaining Books and Records Using an Electronic Storage System (Rev. Proc. 97-22) It also needs an indexing method that lets you locate specific documents, the ability to produce legible printouts on request, and a clear audit trail between the general ledger and the underlying source records. If the IRS examines your books, you are expected to provide the hardware, software, and staff needed to access the files, and to keep a written description of the storage system and its procedures.

Secure Disposal After the Retention Period

Once a record’s retention period ends, keeping it serves no legal purpose and creates unnecessary risk. Cross-cut shredding is the standard for paper. For electronic records, use data-wiping software or physically destroy the storage media, and make sure the process reaches cloud backups and archived email attachments.

Businesses that handle consumer report information — such as credit checks run on job applicants — carry an additional obligation. Federal regulations require anyone who possesses consumer information for a business purpose to take reasonable measures to protect against unauthorized access when disposing of it.15eCFR. Part 682 – Disposal of Consumer Report Information and Records Examples of reasonable methods include shredding or pulverizing paper so it cannot be reconstructed, erasing electronic media so data cannot be recovered, and hiring a professional destruction service. A regular disposal schedule keeps storage manageable and reduces the chance of an accidental data breach.