If you have employees, federal and state laws impose various recordkeeping requirements…what the records must contain and how long you must keep them. This recordkeeping chore certainly isn’t the fun part of running a business, but it’s a necessary one. The failure to comply with recordkeeping requirements can result in serious monetary penalties, which is something you want to avoid. So, follow Kenny Roger’s advice (paraphrasing): “You’ve got to know when to hold ‘em and know when to throw ‘em.”
Federal rules
Different federal laws have different recordkeeping requirements:
- Fair Labor Standards Act (FLSA). Employers must keep records for employees subject to minimum wage requirements (i.e., non-exempt workers) as follows: name, address, hours worked, wages paid rate of pay. Retention period: minimum of 3 years (2 years for timecards).
- Equal Employment Opportunity Commission (EEOC). Employers subject to equal pay provisions must retain records of requests for reasonable accommodation, application forms submitted by applicants, and records dealing with hiring, promotion, demotion, transfer, lay-off or termination, rates of pay, compensation, tenure, selection for training or apprenticeship, or other terms of employment. Retention period: one year from the date of the making of the record or the date of the personnel action.
- Occupational Safety and Health Administration (OSHA). Businesses must keep records of workplace injuries and illnesses, days away from work, restricted work or job transfers, medical treatment, and more. Companies with 10 or fewer employees are generally exempt from this recordkeeping. But all employers, regardless of the number of workers, must keep records of workplace fatalities. Retention period: 5 years.
- Form I-9. This form is used to ensure that people are legally eligible to work in the U.S. and must provide various forms of identification. If you choose to copy or scan documents an employee presents when completing Form I-9, you must retain the copies (or electronic images) with their Form I-9 or their employee record. Retention period: the later of 3 years from the date of hire or 1 year after the date that employment ends.
- IRS. Employers file quarterly employment tax returns—Form 941—that track total wages, income tax withholding, FICA tax, and certain other amounts for all employees. Retention period: 4 years for the returns (and a similar period for the data used to complete the returns).
State rules
The recordkeeping requirements vary considerably from state to state. For example, California just expanded the definition of personnel records to include education and training information.
Retention periods vary considerably, from 5 years, 7 years, or longer.
Protecting and disposing of records
Use care in safeguarding employee information in their personnel records. Failing to do so may be a violation of law.
- Federal laws. Certain laws create specific protections for employees’ information. For example, the Americans with Disabilities Act (ADA) allows employers to ask about a disability after a job offer has been made, and this information must be kept confidential and separate from personnel files. And the Genetic Information Nondiscrimination Act of 2008 (GINA) strictly limits the disclosure of genetic information. You must keep genetic information confidential and in a separate medical file (genetic information may be kept in the same file as other medical information in compliance with the Americans with Disabilities Act).
- State laws. As you may have guessed, the laws vary by state. Connecteam has a 2025 guide to personnel file laws by state.
It’s advisable to have a company policy on how to dispose of employee-related records that are no longer needed. The best disposal methods depend on what’s being disposed:
- Paper files: Shredding is essential. Use a cross shredder or professional shredding services. Burning is another option, but can be hazardous.
- Electronic files: Simply deleting files from a company computer or network may not be sufficient. Using a deletion program such as Secure Eraser is a more secure way of wiping records from your system.
Final thought
Establish policies and procedures for maintaining and retaining required records as well as for disposing of them. Once you have systems in place, it becomes easier to operate your business.
For helpful information about creating necessary company policy, see this list of blogs here.
