Federal compliance records retention periods run from as short as three months for driver vehicle inspection reports to seven years for records supporting bad debt or worthless securities deductions, with most business records falling in a three-to-six-year window. The exact clock depends on which agency regulates the record, and getting the timeline wrong in either direction carries real cost: destroy too early and you face audit or litigation sanctions, hold too long and you expand your exposure if the data is breached.
Federal Retention Periods by Record Type
Tax Records: Three to Seven Years
The IRS default is three years from the date you filed the return, tied to the general limitations period for tax assessment under 26 USC 6501.1Internal Revenue Service. How Long Should I Keep Records Two exceptions stretch that window. If you omit more than 25% of gross income from a return, the assessment period extends to six years, and records supporting that return need to survive that long.2Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection If you claim a deduction for worthless securities or bad debt, keep supporting records for seven years.
Businesses that pay independent contractors $2,000 or more in a tax year (beginning with tax years after 2025) must file Form 1099-NEC and keep records documenting those payments and the contractor’s tax identification information.3Internal Revenue Service. Publication 1099 (2026), General Instructions for Certain Information Returns
Employment Records: One to Three Years, Overlapping
The Fair Labor Standards Act requires employers to keep payroll records, collective bargaining agreements, and sales and purchase records for at least three years.4U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements under the Fair Labor Standards Act The supporting records used to build those payrolls, including time cards, wage rate tables, and work schedules, need to be retained for two years.5eCFR. 29 CFR Part 516 – Records to Be Kept by Employers
The EEOC layers a separate rule on top. All personnel and employment records, from applications through termination letters, must be kept for one year from the date the record was made or the personnel action occurred, whichever is later. For involuntary terminations, the one-year clock starts on the termination date.6U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements Once a discrimination charge is filed, every record related to that charge must be preserved until the matter reaches final disposition, however long that takes.7U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
Form I-9 employment eligibility verifications sit in their own bucket. USCIS recommends storing them separately from general personnel files to make production during an inspection easier.8U.S. Citizenship and Immigration Services. Retention and Storage
Workplace Safety: Five Years
Employers covered by OSHA’s routine recordkeeping rule must keep injury and illness logs (Forms 300, 300A, and 301) for five years after the calendar year they cover, and post the annual summary (Form 300A) in a visible location from February 1 through April 30 each year.9eCFR. 29 CFR 1904.33 Employers with ten or fewer employees, along with businesses in certain low-hazard industries such as retail, finance, and professional services, are exempt from routine recordkeeping.10Occupational Safety and Health Administration. Who is Required to Keep Records and Who is Exempt
Healthcare Compliance: Six Years
HIPAA requires covered entities and their business associates to retain compliance documentation for six years from the date of creation or the date it was last in effect, whichever is later.11eCFR. 45 CFR 164.530 That covers privacy and security policies, risk assessments, business associate agreements, breach notification records, audit logs, and training records.
Patient medical records themselves are not governed by HIPAA. Retention varies by state law, provider type, and patient age. CMS guidelines for Medicare providers call for keeping records seven years from the date of service.
Environmental and Transportation Records
Hazardous waste generators must retain their copies of the EPA Uniform Hazardous Waste Manifest for at least three years from the date the waste was accepted by the initial transporter.12Environmental Protection Agency. Hazardous Waste Manifest System13eCFR. 40 CFR Part 262 Subpart D – Recordkeeping and Reporting Department of Transportation driver hours-of-service and electronic logging device records must be retained for six months; driver vehicle inspection reports have a three-month minimum.
ERISA Retirement Plan Records
Retirement plan recordkeeping under ERISA carries its own penalty schedule. Failure to maintain required records draws fines of up to $37 per employee, and failure to file annual reports draws up to $2,670 per day.14U.S. Department of Labor. Fact Sheet – Adjusting ERISA Civil Monetary Penalties for Inflation
When Retention Clocks Get Overridden
A retention schedule sets the floor, not the ceiling. The moment litigation becomes reasonably foreseeable, whether through a complaint, a demand letter, a government investigation notice, or credible warning of a lawsuit, you must stop routine destruction of any record that could be relevant. This is a litigation hold.
Federal Rule of Civil Procedure 37(e) governs what happens when electronically stored information that should have been preserved is lost. If the loss prejudices another party, the court can order remedial measures. If you acted with intent to deprive the other side of the information, the court can instruct the jury to presume the destroyed records were unfavorable, dismiss your claims, or enter default judgment against you.15Cornell Law Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
When a hold triggers, notify everyone in the organization who handles the affected records, document the hold itself, and pause any scheduled destruction cycles. Courts have sanctioned companies not for losing records they didn’t know about, but for continuing shredding cycles they should have paused.
What a Retained Record Must Actually Contain
A record that survives its retention period but lacks required fields can be treated as if it doesn’t exist. The specific fields vary by regulation, but three elements repeat across nearly every federal framework: the identity of the people involved, the date and time of the action, and some form of authorization tying a responsible person to the record. The FDA’s electronic signature rule captures the pattern: a digitally signed document must include the printed name of the signer, the date and time the signature was executed, and the reason for the signature.16Food and Drug Administration. Important Information About Digital/Electronic Signatures
For digital records, authenticity increasingly rests on metadata captured at the moment of creation: timestamps, device identifiers, and cryptographic hashes that seal a file’s contents against undetected tampering. Federal Rules of Evidence 901 and 902 govern how digital evidence is authenticated, and records without adequate metadata face admissibility challenges.
Fill every required field at the time the action happens. Reconstruction after the fact introduces the kind of inconsistencies auditors are trained to spot.
Digital Storage Rules and Retrieval Standards
Paper-to-digital conversion is broadly accepted, but the electronic system has to meet specific standards. The IRS benchmark comes from Revenue Procedure 97-22: the system must ensure accurate and complete transfer from paper to digital, include reasonable controls against unauthorized changes or deletions, and run an inspection and quality assurance program with regular evaluations.17Internal Revenue Service. Rev. Proc. 97-22 Reproduced records must be highly legible, meaning every letter and number can be identified “positively and quickly.” The system needs an indexing structure that creates an audit trail between source documents and the general ledger.
One provision catches organizations off guard. If your electronic storage system becomes obsolete and you can no longer access the records, the IRS treats those records as destroyed. Switching software platforms or cloud providers without migrating your compliance archives can create a recordkeeping violation out of thin air.17Internal Revenue Service. Rev. Proc. 97-22
The Department of Labor applies similar principles. Systems must include indexing that enables identification and retrieval, and the organization must be able to produce records that are legible both on screen and in hard copy. When an audit opens, you must provide the agency with the hardware, software, and personnel necessary to locate, retrieve, and reproduce any stored records.18U.S. Department of Labor. Electronic Recordkeeping
Retrieval deadlines vary. H-2B visa program records must be produced within 72 hours of a request.19U.S. Department of Labor. Fact Sheet 78I – Records Retention Requirements under the H-2B Program Other agencies use vaguer standards like “reasonable time,” but the practical implication is the same: if your records are so disorganized that an auditor has to wait weeks, expect that delay to shape the investigation.
Security Obligations While You Hold the Records
Keeping records for years means protecting them for years. Financial institutions are subject to the FTC’s Safeguards Rule, which requires a written information security program with administrative, technical, and physical protections scaled to the sensitivity of the information and the size of the business. Covered entities maintaining records on fewer than 5,000 consumers get exemptions from some provisions, but the core obligation to protect customer information applies broadly. As of 2024, financial institutions subject to the Safeguards Rule must report certain security incidents directly to the FTC.20Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know
If breached records contain personal information, state notification laws apply. There is no single federal breach notification law covering all industries. Roughly 20 states set numeric notification deadlines ranging from 30 to 60 days, and most of the rest require notification without unreasonable delay. About 36 states require reporting to the state attorney general or another agency. Triggers and timelines depend on where affected individuals reside, not where the business is located.
Disposing of Records After the Clock Runs Out
Once a record passes its retention period and no litigation hold applies, disposal is often the safer choice. Holding consumer data indefinitely expands your liability if a breach occurs. But the destruction itself has to meet legal standards.
The FACTA Disposal Rule requires businesses that possess consumer information derived from credit reports to destroy it by shredding, burning, pulverizing, or otherwise rendering it unreadable. For digital records, that means wiping files using methods that prevent reconstruction, not simply moving them to a recycle bin. The Gramm-Leach-Bliley Act imposes similar secure destruction requirements on financial institutions handling personal financial information. HIPAA-covered organizations must securely dispose of protected health information in both paper and electronic form.
Best practice is to use a certified destruction service and obtain a certificate of destruction documenting what was destroyed, when, and by what method. That certificate becomes a compliance record in its own right. For digital media, the certificate should include device serial numbers, the sanitization method used, and confirmation that the process was completed. For physical documents, it typically records the date, method (cross-cut shredding, pulverization), and the vendor’s identity.
A formal retention schedule, reviewed annually, that maps each record type to its governing regulation, retention period, and approved destruction method keeps both ends of the problem in check. Without that structure, records either pile up indefinitely, increasing breach risk and storage cost, or get destroyed prematurely, increasing audit and litigation risk.