HR Data Retention: How Long to Actually Keep Employee Records

Ask most small-business owners how long they keep employee records and you'll get some version of "forever, just in case." It feels like the safe answer. It usually isn't.

Indefinite retention is a liability in both directions. Every record you hold is a record you can be compelled to produce in litigation, a record that shows up in a data-breach disclosure, and — if you have employees or applicants in a state with a consumer privacy law — a record someone can ask you to delete. Meanwhile, deleting the wrong thing too early is its own violation. The answer isn't "keep everything" or "keep nothing." It's a written schedule.

What US federal law actually requires

There is no single federal HR retention rule. There are several overlapping ones, each with a different clock, and the practical answer for any given document is whichever period is longest.

FLSA — payroll records for 3 years, wage calculations for 2

The Fair Labor Standards Act sets the baseline for most wage and hour records. Per the Department of Labor's own guidance, employers must preserve payroll records, collective bargaining agreements, and sales and purchase records for at least three years. Separately, the records that wage computations are *based on* — time cards, work and time schedules, wage rate tables, and records of additions to or deductions from wages — must be kept for two years.

That two-tier structure trips people up. The payroll register is a three-year document. The timesheets underneath it are two-year documents. If you're building a schedule, it's simpler and safer to apply the three-year rule to both.

EEOC — personnel records for 1 year, payroll for 3

Under Title VII, the ADA, and related anti-discrimination law, the EEOC requires employers to keep all personnel and employment records for one year. For an employee who was involuntarily terminated, the clock runs one year from the termination date, not from when the record was created.

The ADEA adds a three-year requirement for payroll records, which lines up with FLSA. And records explaining pay differences between employees of different sexes in the same role — the Equal Pay Act documentation — must be kept at least two years.

There's one rule here that overrides all the others: once an EEOC charge is filed, you must preserve all relevant personnel records until final disposition of that charge or any lawsuit arising from it. Routine deletion has to stop for anything touching that matter. If your retention process is automated, it needs a legal-hold switch, or the automation will quietly destroy evidence you were required to keep.

I-9 — the one with the unusual clock

Form I-9 has its own rule and it's the one most often gotten wrong: you keep it for three years after the date of hire, or one year after employment ends — whichever is later. For a long-tenured employee, that's the one-year-after-termination date. For someone who leaves after six months, it's the three-year-after-hire date. It's a comparison, not a fixed period.

I-9s should also live separately from the general personnel file, so you can produce them in an audit without handing over everything else.

Benefit plans and seniority systems

Benefit plans, written seniority systems, and merit systems must be kept for the full period they're in effect, plus at least one year after they end. These are the documents most likely to be missing when someone asks about a decision made years ago.

Why 'keep it forever' is a real risk

The federal minimums above are floors, not ceilings, and plenty of employers reasonably keep certain records longer. But indefinite retention has costs that don't show up until something goes wrong:

• Discovery exposure. In an employment lawsuit, everything you still hold is potentially discoverable. Records you were no longer required to keep can still be used against you.
• Breach scope. If you're breached, your disclosure obligations scale with what you were storing. Ten years of terminated-employee SSNs makes a bad incident significantly worse.
• Privacy-law obligations. Several US state privacy laws now give individuals deletion rights, with employee and applicant data increasingly in scope. "We keep everything indefinitely" is a hard position to defend against a valid deletion request.
• It signals no process. In an audit or a dispute, a written retention schedule that you actually follow is evidence of a functioning compliance program. An undifferentiated archive is evidence of the opposite.

Building a schedule you can actually defend

A workable retention policy is short. It needs four things:

• A category list. Payroll, timesheets, personnel files, I-9s, benefits, medical/ADA accommodation records (which must be stored separately from personnel files), and applicant records. Not every document type — just the categories.
• A retention period per category, set to the longest applicable federal, state, or contractual requirement. State rules frequently exceed the federal floor, so check your states.
• A trigger for each clock. Date of creation, date of hire, or date of termination — this is where most policies are vague, and vagueness is what makes them unenforceable.
• A legal-hold exception that suspends deletion for anything relevant to a filed charge, a threatened claim, or active litigation.

The part most companies skip: actually running it

Here's the failure mode we see most often, and it's worth naming plainly. A company writes a retention policy, publishes it in the handbook, and then never deletes anything — because deletion is a manual task nobody owns, and no calendar reminder ever fires.

That gap matters more than it looks. A published policy you don't follow is arguably worse than no policy: you've documented the standard you're failing to meet. If your privacy policy tells customers or employees that you delete data on a schedule, that statement needs a mechanism behind it, not an intention.

In practice that means the schedule has to be automated, or assigned to a named person with a recurring calendar entry and a place to record what was purged and when. Either works. What doesn't work is assuming it's happening because it's written down somewhere.

A retention policy without an enforcement mechanism isn't a compliance control. It's a statement of intent that a plaintiff's lawyer will happily read back to you.

A note on your HR software

Whatever system holds your employee records should be able to tell you what it retains and for how long, export a full copy of your data on demand, and delete or anonymize an individual's records when you have a legitimate reason to. If a vendor can't answer those three questions clearly, that's worth knowing before you migrate years of sensitive data into their platform.

HRGrove keeps a full audit log of record changes, supports export at any time, and runs retention enforcement on a schedule rather than leaving it as a manual task. If you're evaluating where to keep your HR records, start a free trial or see how it works.

This article is general information, not legal advice. Retention requirements vary by state, industry, and headcount — confirm your specific obligations with an employment attorney before finalizing a policy.