New York State Record Retention Guidelines: Schedules and Penalties

New York record retention requirements vary by document type: three years for sales tax records and real estate transaction files, six years for payroll and most medical records, 18 years for workplace injury logs, 30 years for toxic exposure records, and permanent retention for corporate formation documents and many government records. State law, federal law, and industry-specific rules often overlap, and when they do, the longest applicable period controls. Falling short can mean anything from an estimated tax assessment to a class E felony charge, depending on how and why the records went missing.

Tax and Financial Records

New York Sales Tax

Businesses must keep all sales tax records for at least three years, measured from the return due date or filing date, whichever is later. That covers invoices, receipts, guest checks, and any documentation supporting the amounts reported on a return. If a period is still open because of an audit, investigation, or legal proceeding, the records must be kept until that matter is fully resolved, even after the three years have run.¹

Federal Tax Records

The IRS applies different periods depending on the return and the circumstances:

Three years is the standard period for most returns, running from the filing date.
Four years applies to employment tax records, measured from the date the tax becomes due or is paid, whichever is later.
Six years applies if you omit more than 25% of gross income from a return.²
Seven years applies if you claim a deduction for worthless securities or a bad debt.
Records must be kept indefinitely if you file a fraudulent return or never file at all.

Because the longer windows often aren’t apparent when you file, many tax professionals treat seven years as a practical default for returns and supporting documents.³

Contracts and Corporate Governance

New York’s statute of limitations for breach of contract is six years, so financial records tied to a contractual obligation should be kept at least that long.⁴ Formation documents, bylaws, corporate minutes, partnership agreements, and records of ownership changes should be kept permanently, since they establish the legal identity of the business and can become relevant at any point.

Employment and Payroll Records

Payroll

New York Labor Law Section 195 requires employers to maintain payroll records for at least six years. Those records must show weekly hours worked, pay rates, gross wages, deductions, allowances, and net wages for each employee.⁵ The period matches the statute of limitations for wage claims under New York law.

Workplace Injuries

New York Workers’ Compensation Law requires employers to retain a record of every work-related injury or illness for at least 18 years, whether or not a claim is filed. The Workers’ Compensation Board can review these records at any time.⁶⁷ Many employers assume the requirement applies only to filed claims. It doesn’t.

Federal OSHA rules separately require injury and illness logs (Forms 300, 300A, and 301) for five years after the end of the calendar year they cover.⁸ The 18-year state requirement controls.

Federal Employment Rules

Several federal laws impose retention floors that apply on top of state requirements:

Form I-9 must be kept for three years after the hire date or one year after employment ends, whichever is later.⁹
Private employers must keep EEOC-covered personnel and employment records for one year from creation or the personnel action; involuntarily terminated employees’ records must be kept one year from termination. State and local government employers and educational institutions face a two-year period. If a discrimination charge is filed, related records must be kept until the matter closes.¹⁰
FMLA leave records must be kept at least three years.¹¹
ERISA benefit plan records must be kept at least six years after the filing date of the plan documents they support.

Toxic Exposure Records

Under federal OSHA rules, employee medical records related to toxic substance or hazardous agent exposure must be kept for the duration of employment plus 30 years. Exposure monitoring records, including workplace sampling and biological monitoring results, must be kept at least 30 years.¹² This obligation can outlast the business itself, which surprises many manufacturers and construction firms.

Medical Records

New York hospital regulations require patient medical records to be kept at least six years from the date of discharge. For minors, records must be kept at least three years after the patient reaches age 18 (effectively age 21), or six years from discharge, whichever is longer. Records of deceased patients must also be kept at least six years after death.¹³

The six-year period sits comfortably beyond the medical malpractice statute of limitations under CPLR 214-a, which gives patients two years and six months from the alleged act (or the last date of continuous treatment) to file suit.¹⁴

HIPAA adds its own six-year floor. Covered entities must keep privacy policies, training documentation, business associate agreements, breach notification records, and complaint resolution files for at least six years from when the document was created or last in effect, whichever is later. The rule applies equally to paper and electronic records, and HIPAA civil penalties for violations were adjusted for 2026 to range from $145 per violation for unknowing breaches up to $73,011 for willful neglect, with a calendar-year cap of $2,190,294 for all violations of the same provision.

Financial Industry Records

Broker-dealers and investment advisers face some of the most detailed rules of any industry. SEC Rule 17a-4 divides records into two tiers:

Ledgers, journals, customer account cards, and records relating to account terms and conditions must be kept at least six years, with the first two years easily accessible.¹⁵
Communications (including emails and instant messages), bank statements, cancelled checks, trial balances, and written agreements must be kept at least three years, with the first two years easily accessible.

FINRA Rule 4511 adds a catch-all: any books and records required by FINRA rules without a specified period must be kept at least six years.¹⁶

Financial institutions regulated by the New York Department of Financial Services must also comply with 23 NYCRR Part 500. That regulation requires audit trails of cybersecurity events for at least five years and policies for the secure disposal of nonpublic information that is no longer needed for business operations.¹⁷ Enforcement actions have resulted in multi-million-dollar penalties.

Real Estate and Mortgage Records

Licensed real estate brokers must keep records of each residential transaction for at least three years. Required records include the names and addresses of buyer and seller, the purchase contract or binder, the commission amount, listing agreements, and any documents required under Article 12-A of the Real Property Law.¹⁸

Mortgage bankers and servicers licensed under New York Banking Law must preserve their books, accounts, and records for at least three years. Digital or photographic copies, including optical disk storage, are acceptable as long as they can be examined on request.¹⁹

Education and Other Sector-Specific Rules

Private career schools licensed in New York must keep general records for at least seven years at their principal place of business, and student permanent records for at least 20 years.²⁰ Transcript data and records that track a student’s educational progress fall into the longer category.

Businesses that generate hazardous waste must keep signed manifest copies at least three years from the date the waste was accepted by the initial transporter. If any enforcement action or legal proceeding is pending, the records must be kept until it closes.²¹

Notaries public must retain their official journals for 10 years from the date of the last notarization recorded. Insurance policies deserve special attention: occurrence-based liability policies (like commercial general liability) should be kept indefinitely because claims can arise decades after the policy period, while claims-made policies can reasonably be discarded six years after the tail period expires.

Electronic Records and Litigation Holds

An electronic record has the same legal standing as its paper equivalent in New York, so the same retention periods apply whether a document lives on paper, on a server, or in the cloud. For tax records, the IRS requires that the storage system accurately and completely transfer original records, maintain an indexing system, prevent unauthorized changes, and produce legible hard copies on demand. Abandoning the hardware or software needed to access electronic records without migrating them is treated as destruction.

One obligation overrides every scheduled destruction cycle: the litigation hold. Once you reasonably anticipate litigation, routine destruction of relevant material must stop. A formal lawsuit isn’t required to trigger the duty. A demand letter, a regulatory investigation, or internal discussion of a potential claim can be enough. If a hold isn’t issued and relevant electronic records are destroyed, a court can give an adverse inference instruction, telling the jury it may assume the destroyed evidence was unfavorable to the party that destroyed it.²² Automated deletion systems make this trap easy to fall into.

Proper Disposal

Once a record has passed its retention period, disposal is regulated too. New York General Business Law Section 399-h requires any business holding records with personal identifying information to shred, erase, or otherwise render those records unreadable before disposal. A court can impose a civil penalty of up to $5,000 per violation, with all acts arising from the same incident treated as a single violation.²³

Healthcare providers must dispose of patient records in a manner that prevents unauthorized access, as required by both HIPAA and state health law. Government agencies must follow the State Archives’ destruction procedures, which may require methods like incineration or certified secure shredding for classified or law enforcement materials. Working with a certified destruction vendor and obtaining a certificate of destruction for each batch, including the date, a description of the records, the method used, and a unique tracking identifier, creates an audit trail that answers a regulator’s questions cleanly.

What Happens If You Don’t Comply

Tax Assessments

Businesses that can’t produce sales tax records during a state audit face estimated assessments, fines, and interest. When records are missing, the Department of Taxation and Finance is authorized to estimate the tax owed based on whatever information is available, which rarely favors the taxpayer.

Criminal Charges

Intentionally destroying financial records can cross from compliance into criminal territory. Falsifying business records in the first degree is a class E felony under New York Penal Law Section 175.10 when the alteration or destruction is done with intent to commit or conceal another crime.²⁴ A class E felony carries a maximum prison sentence of four years.²⁵

Destroying evidence that is about to be used in an official proceeding is separately charged as tampering with physical evidence under Penal Law Section 215.40, which applies to private parties and government officials alike.²⁶

Under Public Officers Law Section 89, anyone who willfully conceals or destroys a public record to prevent public inspection is guilty of a violation. That’s the lowest-level offense in New York’s criminal code but still carries potential fines and a criminal record.²⁷

Civil Consequences

In civil cases, New York’s Court of Appeals has held that an adverse inference instruction is appropriate when a party used reasonable diligence to request evidence that was reasonably likely to be material, and that evidence was destroyed.²² A missing document can be treated as proving whatever the other side says it would have shown, which often decides the case.

1
Cornell Law School. N.Y. Comp. Codes R. and Regs. Tit. 20 Section 533.2 – Records to Be Kept
2
Internal Revenue Service. Statutes of Limitations for Assessing, Collecting and Refunding Tax
3
Internal Revenue Service. How Long Should I Keep Records?
4
New York State Senate. New York Civil Practice Law and Rules Law Section 213 – Actions to Be Commenced Within Six Years
5
New York State Senate. New York Labor Law Section 195 – Notice and Record-Keeping Requirements
6
Workers’ Compensation Board. Employers’ Rights and Responsibilities: Workers’ Compensation
7
New York State Archives. Laws and Regulations Related to Records
8
Occupational Safety and Health Administration. Detailed Guidance for OSHA’s Injury and Illness Recordkeeping Rule
9
U.S. Citizenship and Immigration Services. Retaining Form I-9
10
U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
11
eCFR. 29 CFR Section 825.500 – Recordkeeping Requirements
12
Occupational Safety and Health Administration. Access to Employee Exposure and Medical Records
13
Cornell Law School. N.Y. Comp. Codes R. and Regs. Tit. 10 Section 405.10 – Medical Records
14
New York State Senate. New York Laws CVP Section 214-A – Action for Medical, Dental or Podiatric Malpractice
15
FINRA. SEA Rule 17a-4 and Related Interpretations
16
FINRA. 4511. General Requirements
17
Cornell Law School. N.Y. Comp. Codes R. and Regs. Tit. 23 Section 500.13 – Asset Management and Data Retention Requirements
18
New York State Department of State. Real Estate License Law
19
New York State Senate. New York Laws BNK – Banking Article 12-D Section 597 – Books and Records; Reports and Electronic Filing
20
New York State Senate. New York Education Law Section 5002 – Standards for Licensed Private Career Schools
21
eCFR. 40 CFR Part 262 Subpart D – Recordkeeping and Reporting Applicable to Small and Large Quantity Generators
22
New York State Courts. Adverse Inference – Destroyed Evidence
23
New York State Senate. New York General Business Law Section 399-H
24
New York State Courts. Falsifying Business Records in the First Degree Penal Law Section 175.10
25
New York State Senate. New York Penal Law Section 70.00 – Sentence of Imprisonment for Felony
26
New York State Courts. New York Penal Law Section 215.40(2) – Tampering With Physical Evidence
27
New York State Department of State. Article 6 (Sections 84-90) of the NYS Public Officers Law