Employee record retention requirements under federal law run from one year for basic personnel actions to 30 years for medical and chemical-exposure files, with separate clocks set by the EEOC, the Department of Labor, the IRS, USCIS, the Department of Labor’s ERISA rules, and OSHA. Each agency picks its own trigger date, and when two rules cover the same document, the longer period controls. Below is the schedule by document type, followed by what you must do to store, secure, and eventually destroy those records.
Federal Retention Periods by Record Type
There is no single retention deadline. The categories below are organized from shortest to longest. When a document could fall under more than one rule, keep it for the longer period.
One Year: Basic Personnel Records (EEOC)
The Equal Employment Opportunity Commission requires that personnel records related to hiring, promotion, demotion, transfer, or termination be kept for one year from the date the record was made or the personnel action took place, whichever is later. For an involuntary termination, the clock starts on the termination date.1U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
One exception matters more than the rule itself. If an employee files a discrimination charge, you must preserve all related records until the charge is fully resolved, including any litigation and appeals. That obligation overrides the one-year period and can stretch for years.2U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
Two Years: Supplementary Wage Records (FLSA)
Under 29 CFR 516.6, supplementary records like time cards, daily start and stop times, wage rate tables, and work schedules must be preserved for at least two years from the date of last entry.3eCFR. 29 CFR 516.6 – Records to Be Preserved 2 Years These are the supporting documents behind your payroll summaries. If a wage dispute surfaces after you’ve shredded the time cards, you’ve lost your best evidence.
Three Years: Core Payroll Records (FLSA)
The Fair Labor Standards Act requires primary payroll records to be kept for at least three years. That includes hours worked each workday, total wages paid each pay period, and all additions to or deductions from pay.4eCFR. 29 CFR Part 516 – Records to Be Kept by Employers Courts in overtime lawsuits look to these records first. If they don’t exist, the burden can shift to the employer to disprove the employee’s version of what they were paid.
Three Years or One Year After Termination: Form I-9
The I-9 follows its own rule: retain it for three years after the date of hire or one year after the date employment ends, whichever is later.5U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9 For a short-term employee who works only six months, the three-year-from-hire date controls. For a long-tenured employee, the one-year-after-termination date will be later. Do the math for each employee individually.
Four Years: Employment Tax Records (IRS)
The IRS requires you to keep all employment tax records for at least four years after filing the fourth-quarter return for the year. Covered records include wage payment amounts and dates, copies of filed returns, deposit confirmations, W-4 forms, tip allocations, and fringe benefit documentation.6Internal Revenue Service. Employment Tax Recordkeeping Four years is longer than the FLSA’s three-year payroll requirement, so in practice your payroll records should be kept at least four years to satisfy both agencies.
Six Years: Benefits Plan Records (ERISA)
If you sponsor a retirement plan, health plan, or other employee benefit plan, ERISA Section 107 requires you to keep records supporting your plan filings for at least six years after the filing date. That covers Form 5500 filings, nondiscrimination test results, plan documents, and the underlying data used to verify them.7Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records
Thirty Years: Medical and Exposure Records (OSHA)
The longest federal retention period belongs to OSHA. Employee medical records must be preserved for the duration of employment plus 30 years. Exposure records documenting contact with hazardous substances must be kept for at least 30 years from the date they were created.8eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
A few narrow exceptions apply: first-aid records for minor injuries treated on-site by a non-physician, health insurance claims maintained separately from the employer’s medical program, and medical records for employees who worked less than one year, provided those records are given to the employee at termination. Everything else stays for three decades.
Separating Medical Files from the Rest
Not everything can live in the same folder. The Americans with Disabilities Act requires that medical information be collected and maintained on separate forms, in separate medical files, and treated as confidential medical records.9Office of the Law Revision Counsel. 42 USC 12112 – Discrimination Only three groups may access those files: supervisors and managers who need to know about work restrictions or accommodations, first-aid and safety personnel when a disability could require emergency treatment, and government officials investigating ADA compliance. A doctor’s note stored in the same manila folder as a performance review is a compliance failure on its own, regardless of retention.
Storing and Securing What You Keep
For physical records, locked filing cabinets in a restricted-access room are the baseline. Organize files alphabetically or by employee ID number so you can retrieve them quickly during an audit.
Digital records need encryption both in transit and at rest, multi-factor authentication for anyone accessing the system, and regular backups stored in a separate location. Access permissions should be role-based: HR staff get broad access, a direct supervisor sees only what they need for management decisions, and everyone else is locked out.
Put the access rules in writing. A written policy spelling out who can view files and under what circumstances is what stops ad hoc requests from getting rubber-stamped, which is the most common way sensitive information leaks.
Destroying Records After the Retention Period Ends
Once a retention period expires, holding onto sensitive data creates liability rather than reducing it. The FACTA Disposal Rule requires that consumer information, which includes background check reports, credit reports, and similar data obtained from consumer reporting agencies, be disposed of so it cannot be read or reconstructed.10eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records The regulation lists burning, pulverizing, or shredding as acceptable methods for paper. Electronic media must be erased or physically destroyed.
Even for records not covered by FACTA, the same disposal logic applies when files contain Social Security numbers, bank account details, or other personally identifiable information. Cross-cut shredding is the industry standard for paper because it produces fragments too small to reassemble. For digital files, a simple drag-to-trash won’t do; use a certified data-wiping tool or physically destroy the drive.
Keep a destruction log recording the date, the type of records destroyed, and who handled the process. Professional shredding services typically provide certificates of destruction, which serve as proof during an audit that you followed proper procedures.
What Missing Records Actually Cost
The consequences of poor recordkeeping range from per-form fines to losing your ability to defend a lawsuit.
Form I-9 paperwork violations carry fines that currently range from $288 to $2,861 per form for substantive errors like missing sections, expired documents, or forms that were never completed. Technical errors such as a wrong date format or missing middle initial get a 10-business-day correction window before any fine applies. Those per-form amounts add up quickly. With 200 employees and half the forms deficient, the potential penalties reach into six figures.
Missing FLSA payroll records create a different kind of problem. In an overtime or minimum-wage lawsuit, the employer normally bears the burden of showing what was paid and when. Without records, courts frequently accept the employee’s testimony about their hours and pay, and the employer is left trying to prove a negative. The Department of Labor can also assess civil money penalties for certain FLSA recordkeeping failures.11U.S. Department of Labor. Civil Money Penalty Inflation Adjustments
EEOC record failures cut the same way in litigation. If a discrimination charge is filed and the relevant records have been destroyed, the employer loses its documentary defense. Courts may draw adverse inferences, meaning a judge or jury can assume the missing records would have supported the employee’s claims.
State Laws Often Require More
Everything above covers federal requirements, which are the floor, not the ceiling. Many states impose longer retention periods and additional documentation obligations that exceed the federal baselines. State payroll and personnel record retention requirements commonly run four to six years, above the federal one- to three-year minimums for similar records. When a state law and a federal law set different retention periods for the same document type, follow whichever is longer.
State law also fills a gap on employee access. No federal statute gives private-sector employees a blanket right to inspect or copy their own personnel files; the Privacy Act of 1974 covers federal agencies, not private employers.12Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals Many states have their own personnel-file access laws with varying deadlines and procedures, and failing to honor a valid access request can trigger penalties on its own. Check the rules in every state where you employ workers before you build your retention schedule around federal minimums alone.