Records Retention Policy

A Records Retention Policy in the United States sets out the rules and standards the organisation expects those it covers to follow.

The legal basis for records retention requirements in the United States derives from a complex matrix of federal agency regulations, federal statutes, and state laws. No single federal records retention law applies to all businesses — instead, requirements are imposed by the agencies and statutes that regulate each type of record. The Internal Revenue Service (IRS), through IRC § 6001 and Revenue Procedure 98-25, requires taxpayers to maintain records sufficient to establish income, deductions, and credits claimed on tax returns for the applicable statute of limitations period — generally three years, six years for returns with material understatements, and indefinitely for fraudulent returns. The Securities and Exchange Commission (SEC) Rule 17a-4 under the Securities Exchange Act of 1934 requires broker-dealers to retain account records, order tickets, and communications for three to six years. The Occupational Safety and Health Administration (OSHA) 29 C.F.R. § 1904 requires retention of workplace injury and illness records (OSHA Form 300) for five years. The Department of Labor's (DOL) regulations under ERISA require pension plan records to be retained for six years under 29 U.S.C. § 1027.

HIPAA — the Health Insurance Portability and Accountability Act — imposes records retention requirements on covered entities and business associates that handle protected health information (PHI). Under 45 C.F.R. § 164.530(j), covered entities must retain HIPAA policies, procedures, and documentation for six years from the date of creation or the date it was last in effect, whichever is later. Individual states impose additional medical records retention requirements: California Health and Safety Code § 123111 requires six years for adult medical records; New York Public Health Law § 18(3)(d) requires six years or three years after the patient's death.

Federal contractors and grantees are subject to records retention requirements under the Federal Acquisition Regulation (FAR) § 4.703, which generally requires contractors to retain contract records for three years after final payment, and under the Uniform Administrative Requirements applicable to federal grants (2 C.F.R. § 200.334), which requires grantees to retain grant records for three years after submission of the final financial report.

The Federal Rules of Civil Procedure impose a duty to preserve evidence that arises when litigation is 'reasonably anticipated' — before a lawsuit is filed. FRCP Rule 37(e) provides for sanctions (including adverse inference instructions and case-dispositive sanctions) against a party that fails to take reasonable steps to preserve electronically stored information (ESI) after the duty to preserve arises. A Records Retention Policy that includes a litigation hold procedure — suspending normal destruction when litigation is anticipated — is the standard tool for demonstrating compliance with the preservation duty.

State law imposes additional records retention requirements that vary by jurisdiction. California's Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 et seq., does not mandate specific retention periods but requires businesses to disclose their data retention practices and to delete consumer personal information upon request. New York's SHIELD Act and other state data protection laws impose security requirements on retained records. Many state employment laws impose specific retention periods for payroll records, tax withholding records, and employment applications that differ from and sometimes exceed federal requirements.

A Records Retention Policy in the United States is needed by every business — regardless of size — that creates, receives, or maintains records in the course of its operations, because every business is subject to at least some federal or state records retention requirements and faces potential litigation that triggers evidence preservation duties.

A Records Retention Policy is needed before a business faces an IRS audit or tax examination. The IRS has authority under IRC § 7602 to examine a taxpayer's books, records, and other data. A business that cannot produce tax records — because it destroyed them without a policy or retained them without organization — faces the risk of the IRS reconstructing income by other means, which typically produces a higher tax assessment than the actual tax due. A documented retention policy demonstrates that records practices were systematic and in good faith.

The policy is needed before litigation arises. Once a business receives a demand letter, regulatory inquiry, or learns of circumstances that could result in a lawsuit, the duty to preserve relevant documents attaches immediately. A business with an existing Records Retention Policy can immediately implement a litigation hold (suspending normal destruction for affected records) and document its compliance. A business without a policy has no framework for doing so and risks spoliation sanctions under FRCP Rule 37(e) — including sanctions as severe as dismissal of the defendant's case or default judgment for the plaintiff in egregious cases.

A Records Retention Policy is needed for HIPAA compliance by any healthcare provider, health plan, or business associate that handles PHI. The HHS Office for Civil Rights (OCR) enforces HIPAA and has imposed civil monetary penalties ranging from $100 to $1.9 million per violation category for HIPAA violations, including records management failures. A documented records retention policy with HIPAA-specific retention periods and security protocols is a fundamental requirement of HIPAA compliance.

The policy is needed for SEC-registered broker-dealers, investment advisers, and public companies that are subject to SEC books and records requirements under Exchange Act Rules 17a-3 and 17a-4 and Investment Advisers Act Rule 204-2. SEC examination staff routinely test records retention compliance, and failures to maintain required records have resulted in significant enforcement actions and penalties.

A Records Retention Policy is needed as part of a broader data governance program for any business that collects and retains consumer personal information subject to the CCPA, New York SHIELD Act, Virginia CDPA, Colorado Privacy Act, or other state privacy laws. These laws require businesses to disclose how long they retain personal data and to honor consumer deletion requests — both of which require a defined retention policy.

A Records Retention Policy for a US business must address every major category of business record, specify retention periods with legal bases, set out destruction procedures, and include a litigation hold protocol.

The scope and applicability clause defines which records are covered by the policy (all records created, received, or maintained by the organization in any format — paper, electronic, email, text message, social media, voicemail, database records), which employees and contractors are subject to the policy, and how the policy interacts with records maintained by third-party service providers and cloud storage platforms.

The records retention schedule is the operational core of the policy. The schedule organizes records by category and specifies the retention period and legal basis for each. Key retention categories and minimum periods for US businesses include:

Tax and accounting records: IRS requires records supporting tax returns for the longer of three years (standard statute of limitations), six years (if underreported income by more than 25%), or seven years (if worthless securities or bad debt deduction claimed). Best practice: seven years for all tax and accounting records. Corporate and legal entity records (articles, bylaws, board minutes, shareholder records): permanent. Employment records (applications, hiring records, I-9 forms, payroll records): four to seven years depending on federal and state law; I-9 forms for the longer of three years from hire or one year from termination under 8 C.F.R. § 274a.2. OSHA injury and illness records (Form 300, 300A, 301): five years under 29 C.F.R. § 1904.33. ERISA plan records: six years under 29 U.S.C. § 1027. SEC records (broker-dealers): three to six years under Rule 17a-4. Contracts and agreements: statute of limitations plus three to six years (four to six years for written contracts in California, New York, and Texas). HIPAA records: six years from creation or last effective date under 45 C.F.R. § 164.530(j).

The litigation hold procedure is mandatory for legal defensibility. The policy must specify: what events trigger a litigation hold (receipt of a demand letter, service of legal process, notice of government investigation, or any circumstances creating reasonable anticipation of litigation or regulatory inquiry); who is responsible for issuing the hold notice (typically the General Counsel or outside counsel); how the hold notice is communicated to employees with potentially relevant records; what records categories are covered by the hold; and how hold compliance is monitored and documented. FRCP Rule 37(e) safe harbor protection depends on the organization having taken 'reasonable steps to preserve' ESI after the preservation duty arose — a formal, documented hold procedure is the standard evidence of reasonable steps.

The electronic records management provisions address the special requirements for electronically stored information (ESI): email retention (often the largest single records category for most businesses); records maintained in cloud platforms such as Microsoft 365, Google Workspace, Salesforce, and Dropbox; instant messaging and collaboration platform data (Slack, Microsoft Teams); mobile device records (text messages, WhatsApp); and accounting and ERP system data (QuickBooks, SAP, Oracle). The policy must specify whether electronic records are treated as originals, whether metadata must be preserved, and the backup and archival procedures for each platform.

The secure destruction procedures clause specifies how records at the end of their retention period are destroyed: paper records must be shredded (cross-cut shredding to NIST guidelines or destruction by a certified shredding vendor under a Certificate of Destruction); electronic media must be sanitized to NIST SP 800-88 standards (overwriting, degaussing, or physical destruction of hard drives); and cloud-stored records must be deleted through the platform's certified deletion process with confirmation documentation. Records subject to a litigation hold must never be destroyed, even if they have passed their scheduled retention period, until the hold is formally released.

The policy governance provisions specify: who is responsible for administering and updating the policy (Records Manager, Compliance Officer, or General Counsel); the schedule for periodic review and update (at least annually, and whenever applicable law changes); employee training requirements (all employees must receive training on their records retention obligations at hire and annually thereafter); and the consequences of non-compliance with the policy (which may include disciplinary action up to termination for willful destruction of records subject to a litigation hold).