Data Retention Policies: What Businesses Need to Know

Every business accumulates data. Customer records, employee files, financial statements, contracts, emails, tax documents, health records, payment information — the list is long and grows over time. At some point, someone asks the inevitable question: how long do we have to keep this? The honest answer is that it depends, and the variables include the type of data, the applicable laws, the industry, the jurisdiction, and the circumstances of the business. Getting data retention wrong in either direction — deleting records too soon or keeping them longer than necessary — creates real legal and operational risk.

Why Data Retention Matters

There are two distinct failure modes for data retention: keeping data too long and deleting it too soon. Keeping data longer than necessary exposes the business to greater risk if there is a data breach, because old data that is no longer needed for any business purpose is still a liability if it is compromised. Privacy laws increasingly require businesses to delete personal information when it is no longer needed for the purpose for which it was collected. And in litigation, data that has been retained can be subject to discovery — which means your business may be required to produce it to an opposing party in a lawsuit even if you would prefer not to.

Deleting data too soon creates the opposite problem: you may fail to satisfy legal obligations that require records to be kept for a minimum period, and you may destroy evidence that you would need to defend a legal claim against your business. Tax records, employment records, financial statements, contracts, and other documents are subject to retention requirements that exist specifically because regulators and courts need them to be available for extended periods.

Privacy Law Data Minimization and Retention Principles

Modern data protection laws — including the GDPR, the CCPA, and most of the new wave of state privacy laws — include a principle of data minimization, which requires businesses to collect only the personal data they actually need for specified purposes and to retain it only for as long as those purposes require. This storage limitation principle means that keeping personal data indefinitely, or keeping it without a clear purpose, is a compliance violation, not just an operational inefficiency.

The GDPR’s storage limitation principle, found in Article 5(1)(e), requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for which it is processed. The law does not specify exact retention periods — instead, it requires organizations to determine appropriate retention periods based on the specific purposes of the processing. Organizations subject to the GDPR must document their retention periods and the justification for them.

California’s privacy law similarly expects businesses to disclose how long they retain each category of personal information and the criteria used to determine the retention period. The California Privacy Protection Agency’s regulations require businesses to retain personal information only as long as reasonably necessary for the disclosed purposes, and no longer.

Tax and Financial Records

Federal tax law establishes minimum retention periods for tax-related records. The IRS generally has three years from the date a return is filed to assess additional taxes, which means records should be kept for at least that long. However, if income is understated by more than 25%, the IRS has six years to assess additional taxes. If no return was filed or a fraudulent return was filed, there is no limitation period at all. A conservative approach for most businesses is to retain tax records — including returns, supporting schedules, receipts, and relevant financial records — for at least seven years.

Financial records more generally should be retained for the period sufficient to satisfy tax requirements plus any additional requirements imposed by applicable accounting standards, lender agreements, or investor obligations. General ledgers, audited financial statements, and corporate records are often retained permanently because they may be needed in connection with corporate transactions, regulatory inquiries, or litigation that arise long after the underlying transactions.

Employment Records

Employment records are subject to retention requirements under multiple federal laws, and the applicable period depends on the specific type of record. The Equal Employment Opportunity Commission requires employers to retain personnel and employment records — including job applications, records of promotions and terminations, and pay records — for at least one year from the date the record was made or the personnel action was taken, whichever is later. For employers subject to the Age Discrimination in Employment Act, payroll records must be retained for three years.

The Department of Labor requires employers to retain records relating to minimum wage and overtime compliance under the Fair Labor Standards Act for at least three years. I-9 employment eligibility verification forms must be retained for three years from the date of hire or one year after termination, whichever is later. OSHA requires employers to retain records of work-related injuries and illnesses for five years. ERISA imposes six-year retention requirements for records relating to employee benefit plans.

These federal requirements establish minimum periods; many employers retain employment records for a longer period — often seven to ten years after termination — because employment claims can arise long after the employment relationship ends, and having complete records is often essential to defending such claims.

Contracts and Corporate Records

Contracts should be retained for at least the duration of the contract plus the applicable statute of limitations for breach of contract claims, which varies by state but is commonly three to six years. Many businesses retain contracts for seven to ten years after expiration or termination. Some contracts — particularly real estate transactions, major vendor agreements, and agreements relating to intellectual property — are worth retaining permanently or for as long as the underlying rights or obligations may be relevant.

Corporate records — articles of incorporation, bylaws, board and shareholder meeting minutes, stock ledgers, equity agreements, and similar documents — should generally be retained permanently. These records establish the legal history of the company and are essential in connection with financing transactions, acquisitions, regulatory inquiries, and litigation. The loss of corporate records is a serious problem that can take years and significant resources to remedy.

Customer Data

The appropriate retention period for customer data depends on the type of data, the purpose for which it was collected, and the applicable legal requirements. Transaction data is often retained for the period necessary to satisfy accounting and tax obligations, typically three to seven years. Customer contact information used for ongoing business communications may be retained as long as the customer relationship is active plus a reasonable period after it ends.

For businesses subject to privacy laws, customer personal data must be retained only as long as necessary for the disclosed purposes. This means businesses should identify, for each category of customer data they collect, the specific purpose of the collection and a retention period justified by that purpose. A customer’s email address collected for transactional purposes might appropriately be retained for the duration of the customer relationship plus the period needed for any related legal or accounting obligations. The same email address collected for marketing purposes should be deleted when the customer opts out or when the business no longer has a legitimate marketing relationship with that customer.

Health Records and HIPAA

For businesses subject to HIPAA, the retention of medical records is governed by applicable state law, since HIPAA itself does not specify a general medical records retention period. Most states require medical records to be retained for at least seven to ten years, with longer periods required for records relating to minors. HIPAA does require covered entities and business associates to retain documentation of their HIPAA policies and procedures for at least six years from the date the document was created or the date it was last in effect, whichever is later.

Building a Data Retention Policy

A data retention policy is a written document that establishes how long the business retains different categories of information and the process for securely disposing of records when they are no longer needed. A good policy identifies each category of information the business holds, specifies the applicable retention period and the legal or business basis for that period, assigns responsibility for implementing the retention schedule, and establishes procedures for secure deletion or destruction of records that have reached the end of their retention period.

The policy should also address litigation holds: when litigation is threatened or commenced, normal destruction schedules must be suspended for any records that may be relevant to the dispute. Destroying records after a lawsuit has been filed or after litigation is reasonably anticipated is spoliation, which can result in severe sanctions, adverse inferences, or other consequences in the litigation. A litigation hold procedure ensures that the normal destruction schedule does not inadvertently destroy relevant evidence.

Data retention is one of those compliance areas where the right answer is specific to the business: its industry, its legal environment, the types of data it holds, and the legal claims to which it is most likely to be exposed. Working through a retention schedule with a business attorney and, if applicable, a tax advisor is the most reliable way to ensure the policy appropriately balances the competing risks of keeping data too long and deleting it too soon.