Keep what the law expects, delete what you no longer need

The short answer

For federal purposes, most small business tax records should be kept for at least three years after you file, according to the IRS, with longer periods in some cases: six years if income was substantially underreported, seven years for bad debt or worthless securities deductions, and indefinitely if a return was not filed or was fraudulent. Employment tax records must be kept for at least four years. Payroll records under the Fair Labor Standards Act must be kept for three years.

Many accountants recommend keeping core tax records for seven years to cover the longer cases. State law, your industry, contracts and insurers can require more. Treat the periods below as a starting point to confirm with your accountant or attorney. This article is general information, not legal or tax advice.

Common federal retention periods

These are the periods most small businesses meet first, from the agency that sets them. Deciding how long to keep records means taking the longest period that applies to each record type, because one document can fall under several rules. A payroll register, for example, is both an FLSA payroll record and an IRS employment tax record, so the four-year IRS period governs unless state law or your accountant says longer.

Tax records (IRS)

• 3 years from filing for most income tax records
• 3 years from filing or 2 years from payment, whichever is later, if you file a claim for credit or refund
• 6 years if you leave out income of more than 25 percent of the gross income shown on the return
• 7 years if you claim a loss from worthless securities or a bad debt deduction
• Indefinitely if you do not file a return or file a fraudulent one
• At least 4 years for employment tax records, from the date the tax is due or paid, whichever is later
• Property records until the limitation period expires for the year you dispose of the property

Payroll and wage records (Department of Labor)

• 3 years for payroll records under the FLSA
• 2 years for records wage calculations are based on, such as time cards and wage rate tables

Personnel records (EEOC)

• 1 year for personnel and employment records such as applications and hiring decisions, or 1 year from termination for an involuntarily terminated employee
• Until final resolution of any discrimination charge or lawsuit, for records relevant to it

Form I-9 (USCIS)

• 3 years after the date of hire or 1 year after employment ends, whichever is later, for former employees; for as long as current employees stay

Injury and illness logs (OSHA)

• 5 years following the end of the calendar year covered, for OSHA 300 logs, 301 incident reports and annual summaries, where your business is required to keep them

Records that often need longer

• Corporate records such as articles, bylaws, minutes and ownership records, usually kept permanently
• Contracts and leases, typically for the life of the agreement plus a period set by your state’s limitation rules
• Real estate and major asset records, until the property is sold plus the IRS limitation period
• Health, legal and financial client files, where regulators and professional bodies set their own rules
• Records under a legal hold, which must be kept regardless of normal schedules

Ask your accountant and attorney to review your list once, then record the agreed period for each record type in a written schedule.

Why keeping everything forever is a mistake

Holding every file indefinitely feels safe, but it creates its own risks. Old data is still data that can be stolen in a breach, and the more personal information you hold, the larger the potential notification and cleanup burden. It must also be searched and produced if you are sued, which raises legal costs. And storage, backup and migration costs grow every year.

A written retention schedule, applied consistently, lets you show that records were disposed of as a routine matter rather than selectively.

Not sure where your records actually live? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

How to build a retention schedule

1. List record types, not individual files: tax returns, invoices, payroll, personnel files, contracts, client files, email.
2. Record where each lives: accounting software, payroll provider, Microsoft 365, Google Workspace, file server, paper.
3. Assign a retention period agreed with your accountant or attorney, and what event starts the clock: filing date, termination date or contract end.
4. Assign an owner for each record type.
5. Decide how disposal happens: automatic deletion, secure shredding or wiping, and who approves it.
6. Write down the legal hold process, so deletion stops immediately when litigation or an investigation is expected.

How to automate retention and disposal

Manual cleanup rarely happens. Both major productivity platforms can enforce your schedule.

• Start with a default policy for email, for example retention for the period your counsel recommends, then add longer rules for finance and HR.
• Test policies on a pilot group before applying them to everyone, because deletion rules are permanent.
• Remember that retention in the platform is not a backup. You still need separate, tested backups.
• Check that third-party systems, such as payroll and accounting platforms, keep data for your required periods, and export before you cancel any service.

Disposing of records securely

• Shred paper records with a cross-cut shredder or a bonded shredding service, and keep certificates of destruction.
• Wipe or destroy drives in retired computers, copiers and servers. NIST’s media sanitization guidelines describe clear, purge and destroy methods.
• Remove former employees’ mailboxes and drives on schedule, after any required retention period, rather than keeping inactive licenses forever.
• Log what was destroyed, when and by whom.

JLB USA manages Microsoft 365 and Google Workspace, backups and tested restores as part of our managed IT service for businesses with roughly 25 to 100 employees, and can set up retention policies once your accountant or attorney confirms the periods. When staff leave, our offboarding checklist covers preserving their data before accounts are removed.

Keep reading

• How to build an IT budget for a small business (with a simple template)
• Break-fix vs managed IT services: which costs less over three years?
• Entra ID vs Active Directory: can a small business drop its domain controller?
• How to choose a managed service provider in Atlanta

Related services

• Managed IT services
• Employee offboarding IT checklist
• Free Technology Health Assessment