Document retention guidelines are the rules that tell you how long to keep each type of business record before you can safely destroy it. The periods run from three years for routine tax and payroll files, to six or seven years for certain tax situations, to 30 years for employee medical and chemical exposure records, to permanent for articles of incorporation, deeds, and intellectual property filings. Getting the timeline wrong can cost you deductions in an audit, sink a discrimination defense, or in the worst case trigger felony obstruction charges for destroying records during a federal investigation.
Tax and Financial Records
The IRS ties retention to the statute of limitations for assessing additional tax. For most returns, that is three years from the date you filed, or two years from the date you paid the tax if that is later.1Internal Revenue Service. How Long Should I Keep Records Three years covers the receipts, invoices, bank statements, and canceled checks that back up a typical return.
The window stretches in specific situations. Keep records six years if you omitted more than 25 percent of the gross income shown on your return, and seven years if you claimed a deduction for a bad debt or a loss from worthless securities.1Internal Revenue Service. How Long Should I Keep Records Those longer windows match extended assessment periods in the tax code.2Office of the Law Revision Counsel. 26 US Code 6501 – Limitations on Assessment and Collection
Two situations require holding records forever: filing a fraudulent return, and not filing at all. In both cases there is no statute of limitations on IRS assessment, so the underlying records need to be available whenever the IRS decides to look.2Office of the Law Revision Counsel. 26 US Code 6501 – Limitations on Assessment and Collection
Property and Depreciable Assets
Records for property, whether a home, a rental building, or business equipment, run on a different clock. Keep purchase records, improvement receipts, and depreciation schedules for the entire time you own the asset, plus at least three years after the return for the year you sell or dispose of it.1Internal Revenue Service. How Long Should I Keep Records For property received in a tax-free exchange, hold the records on both the old and new property until that final period runs out.
Employment and HR Records
Federal labor laws scatter retention rules across several agencies. No single deadline covers all employee records, so most employers end up layering timelines.
Personnel Files
The EEOC requires all personnel and employment records to be kept for at least one year from the date the record was made or the personnel action occurred, whichever is later. For involuntary terminations, the one-year clock starts on the termination date. If a charge of discrimination has been filed, every record related to the charge must be preserved until final disposition of the matter, including any court proceedings.3U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
Payroll and Wage Records
The Fair Labor Standards Act requires employers to preserve payroll records, including hours worked, wage rates, and total earnings, for at least three years from the last date of entry.4eCFR. 29 CFR 516.5 – Records to Be Preserved 3 Years Employment tax records like Forms W-2 and payroll tax deposits fall under a separate IRS rule: keep them at least four years after the tax becomes due or is paid, whichever is later.1Internal Revenue Service. How Long Should I Keep Records Because payroll records serve both purposes, the practical minimum is four years.
Form I-9
Keep a completed Form I-9 for each employee for three years after the date of hire, or one year after employment ends, whichever is later.5USCIS. 10.0 Retaining Form I-9 For long-tenured employees, the “one year after separation” date almost always controls.
OSHA Medical and Exposure Records
OSHA imposes the longest retention periods in employment law. Employee medical records must be preserved for the duration of employment plus 30 years. Employee exposure records, including monitoring data for chemical or physical hazards, must also be kept for at least 30 years.6Occupational Safety and Health Administration. Access to Employee Exposure and Medical Records One exception applies: if an employee worked less than one year, the records can be given to the employee at termination instead of stored.
Employee Benefit Plans
ERISA requires anyone who files (or would be required to file) benefit plan reports to retain the underlying records for at least six years from the filing date.7Office of the Law Revision Counsel. 29 US Code 1027 – Retention of Records Those records must be detailed enough to verify, explain, and check the accuracy of the filed documents, and include vouchers, worksheets, receipts, and applicable resolutions. Many plan administrators hold records for the life of the plan plus several years, because participant claims can surface long after a plan year ends.
Corporate, Contract, and Intellectual Property Records
Documents that establish your organization’s legal existence and rights should be kept permanently. Articles of incorporation, bylaws, all amendments, and formal minutes of board or member meetings document decisions that define the entity. Deeds, trademark and patent registrations, and any other record that proves ownership or legal rights sit in the same category. Destroying them creates risk with no offsetting benefit.
Contracts
Signed contracts should be kept for the life of the agreement plus long enough to cover a potential breach lawsuit. Under the Uniform Commercial Code, which governs the sale of goods, the limitations period is four years after the breach.8Legal Information Institute. UCC 2-725 – Statute of Limitations in Contracts for Sale For other written contracts, state limitations vary widely, from three years to as long as 15 or 20 years. A reasonable general rule: retain signed contracts for at least 10 years after the agreement expires or is fully performed, which covers most state periods.
Industry-Specific Requirements
Several industries face retention rules that overlay everything above.
HIPAA Compliance Documentation
A common misconception is that HIPAA sets retention periods for patient medical records. It does not. State law governs how long medical records themselves must be kept. What HIPAA does require is that covered entities retain their compliance documentation, including written privacy policies, risk assessments, training records, and business associate agreements, for six years from the date of creation or the date the document was last in effect, whichever is later.9eCFR. 45 CFR 164.530 – Administrative Requirements The six-year clock restarts each time a policy is updated and the old version ceases to be effective.
SEC Broker-Dealer Records
Broker-dealers registered with the SEC must preserve all business communications, including emails, inter-office memos, and client correspondence, for at least three years. During the first two of those years, records must be kept in an easily accessible location.10eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers Electronic records under this rule must either maintain a complete time-stamped audit trail or be stored in a format that cannot be rewritten or erased.
Audit Workpapers for Public Companies
The Sarbanes-Oxley Act requires accountants who audit public companies to retain all audit and review workpapers for five years from the end of the fiscal period in which the audit or review concluded.11U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews The rule covers not only formal workpapers but also correspondence, memos, and any document containing conclusions or financial data related to the audit.
Penalties for Getting It Wrong
Consequences range from lost deductions to prison, depending on whether the failure looks like negligence or obstruction.
IRS Accuracy Penalty
If inadequate records lead you to understate your tax liability, the IRS can impose an accuracy-related penalty of 20 percent of the underpayment attributable to negligence or disregard of the rules.12Internal Revenue Service. Accuracy-Related Penalty Without records to substantiate deductions, you have no defense in an audit, and the IRS will disallow whatever it cannot verify. The penalty applies on top of the additional tax owed.
Criminal Liability for Destroying Records
Intentionally destroying records to obstruct a federal investigation is a felony under 18 U.S.C. § 1519, with a maximum sentence of 20 years in prison.13Office of the Law Revision Counsel. 18 US Code 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy Enacted as part of Sarbanes-Oxley, the statute applies broadly to any matter within the jurisdiction of a federal agency, not just securities cases. Intent is the line: routine destruction under an established retention policy is fine; shredding documents because you know investigators are coming is not.
Improper Disposal of Consumer Information
Businesses that handle consumer report information, including credit reports, employment background checks, and insurance claims data, must dispose of it in a way that prevents unauthorized access. The FTC’s Disposal Rule, which implements the Fair and Accurate Credit Transactions Act, requires burning, pulverizing, or shredding paper records so the information cannot be reconstructed, and destroying or securely erasing electronic media.14eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information Violations can produce civil penalties per incident, and enforcement actions have produced six-figure settlements.15Federal Trade Commission. FACTA Disposal Rule Goes into Effect June 1
Litigation Holds Override Everything
Every retention schedule has an exception. When your organization reasonably anticipates litigation or a government investigation, normal destruction must stop immediately for any records that could be relevant. The legal team should issue a written directive identifying the categories of records covered and the employees who hold them. This applies to paper files and electronically stored information alike. Courts treat spoliation of evidence seriously, and penalties for destroying records after a hold should have been in place can include adverse inference instructions, monetary sanctions, or dismissal of claims.
Secure Destruction
Once a record’s retention period has passed and no hold is in effect, destroy it. Keeping records past their required period doesn’t protect you. It creates discoverable material in future lawsuits and increases exposure under privacy laws.
Physical documents containing personal or financial information should be cross-cut shredded rather than strip-shredded. Electronic records require secure wiping or physical destruction of the storage media so the data cannot be recovered. For third-party destruction vendors, get a certificate of destruction for every batch documenting the date, method, and chain of custody.
Federal credit union regulations offer a useful model even outside that industry: prepare an index of destroyed records, signed by at least two people attesting that destruction actually occurred, and retain the index permanently.16eCFR. Part 749 – Records Preservation Program and Appendices The practice gives you an auditable trail that proves you followed your policy.