Getting started
How long should a business keep records? A retention schedule
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
How long to keep business records depends on the record type and the rule behind it: tax assessment windows, employment and benefits laws, contract terms, statutes of limitation and any legal hold. No single number fits every record. Set each period with your CPA and counsel, and review operational records for business value before deleting anything.
Key takeaways
- Retention periods come from specific rules, so each record type needs its own driver and clock start.
- A legal hold overrides the schedule for covered records until counsel lifts it in writing.
- Closing a business does not end retention duties for tax, payroll and employee records.
- The end of a minimum period allows deletion; whether deletion is required depends on privacy laws, contracts and policy.
- Operational records such as job histories and support tickets deserve a value review before disposal.
Is there one rule for how long to keep business records?#
There is no single rule for how long to keep business records; each record type has its own minimum set by tax, employment, contract or industry rules. A retention schedule works by listing record types, the rule that sets each period and the event that starts the clock.
Many companies default to keeping everything or deleting on a round number. Both cause trouble. Keeping everything raises breach and discovery exposure, while a blanket deletion rule can destroy records a tax authority, regulator or court can still ask for.
This is general information, not tax or legal advice. Periods differ by jurisdiction and situation, so confirm each one with your CPA and counsel before you adopt it.
A retention schedule by record type#
A retention schedule by record type should name what sets each period rather than guess at a figure. The table shows common record types in a mid-size company, what usually drives their retention, when the clock tends to start and whether they deserve a value review before disposal.
Where a record type falls under several rules, the longest applicable period usually controls. Your CPA can confirm tax periods; employment counsel can confirm personnel, payroll and benefits periods.
The clock-start column matters as much as the period. A contract kept from its signing date rather than its termination date can be destroyed while the contract is still running, and a personnel file timed from hire rather than departure can disappear while the employee still works there.
| Record type | What usually sets the period | Clock usually starts | Review for value before deletion? |
|---|---|---|---|
| Tax returns and supporting records | IRS period of limitations: generally 3 years, 6 if unreported income exceeds 25% of reported gross income, 7 for a worthless securities or bad debt deduction, indefinitely if no return or a fraudulent return was filed; state rules may differ | Filing date of the return | Rarely; mostly numeric |
| Property and equipment records | IRS: until the limitations period ends for the year the property is disposed of | Disposal of the asset | Sometimes; maintenance histories can be rich |
| General ledger, invoices and bank records | Tax rules, lender covenants and audit needs | End of the fiscal year | Rarely; keep summaries |
| Payroll and employment tax records | IRS: employment tax records at least 4 years; wage-and-hour and state rules may add their own periods | Date the tax is due or paid, whichever is later | No; heavy in personal data |
| Personnel files and benefits records | Employment, anti-discrimination and benefits laws | End of employment | No; dispose per schedule |
| Customer contracts and amendments | Statutes of limitation and the contract's own terms | Expiration or termination | Sometimes; note use restrictions |
| Support tickets and chat transcripts | Customer contracts, privacy notices and company policy | Ticket closure | Yes; often rich operational content |
| Job, dispatch and service records | Warranty terms, licensing boards and contracts | Job completion or warranty end | Yes; links work to outcomes |
| Quality, maintenance and inspection records | Customer requirements, industry rules and liability exposure | Shipment or asset retirement | Yes; root causes and fixes |
| Driver records of duty status (motor carriers) | FMCSA guidance on 49 CFR 395.8(k)(1): at least six months with supporting documents | Date of receipt | Rarely; telematics settings may delete sooner |
| Business email and chat | Litigation exposure, company policy and employee notices | Message date | Selectively; mixed content |
How does a legal hold change the schedule?#
A legal hold suspends the retention schedule for records relevant to actual or reasonably anticipated litigation, an investigation or an audit. Once counsel issues a hold, deletion of covered records stops, including automatic deletion in email, chat and backup rotation.
Holds fail most often at the edges. A hold reaches the email system but not the help desk, the CRM or the file shares where relevant records also live, and an automated cleanup rule runs on schedule.
- Name the matter, the record types and the date range the hold covers.
- Identify every system holding those records, including archives and old exports.
- Suspend automated deletion rules in each of those systems.
- Notify custodians in writing and log their acknowledgments.
- Review the hold with counsel and lift it in writing when the matter ends.
How long to keep records after closing a business#
Records usually must be kept after closing a business for as long as the underlying tax, employment and contract rules still apply. Dissolving the legal entity does not end the period in which tax authorities can examine returns or former employees can request their records.
A wind-down plan should name a records custodian, a storage location and a budget that outlasts the entity. Payroll and employee files, final tax returns with their support, and contracts with open warranty or indemnity obligations need the most care.
Operational archives are a separate question. Support history, job records or quality logs may carry no remaining legal duty yet still hold value. Reviewing them before systems are shut off preserves the option to de-identify and license them later.
What should happen when a retention period ends?#
When a retention period ends, the record owner decides whether to delete, de-identify, keep or archive, and writes down why. The end of a minimum period allows deletion; whether deletion is required depends on privacy laws, contracts and the company's own policy.
Disposal itself needs a method the company can prove later. Shredding paper, deleting files from every copy including backups and old exports, and wiping retired drives each leave a trail: a certificate of destruction from a vendor or a deletion log from IT shows the schedule was followed.
| Decision | When it fits | What to document |
|---|---|---|
| Delete | Records are mostly personal data or have no continuing use | Date, method and approver |
| De-identify and keep | Content has operational value once personal details are removed | The method used and who reviewed it |
| Keep as is | A hold, dispute or contract still applies | The reason and the next review date |
| Archive offline | Rarely needed but costly to lose | Location, access rules and review date |
Illustrative: an electrical contractor dissolves its old entity#
Illustrative: a fictional electrical contractor sells its operating business in an asset sale, and the old entity begins to dissolve. The buyer took current customer contracts and open jobs; the seller kept historical records, including years of service tickets in its field service software, payroll records and closed project files.
The CFO works with the company's CPA and counsel to list each record type and its driver. Payroll, personnel and tax records go to a secured archive under a named custodian. Two open warranty claims put a hold on the related job files.
Before the field service subscription lapses, the CFO exports the full job history, including technician notes and callbacks. Those records carry no remaining legal duty, but the owners want them reviewed for licensing value before any deletion decision.
How SourceX treats records at the end of retention#
SourceX reviews operational records, not tax, payroll or personnel files. When a company considers licensing records that have reached the end of their retention period, the Preparation step removes personal and confidential details, and the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization. Records under a legal hold stay out of scope until counsel lifts it.
Frequently asked questions
How long should we keep business email?
Email has no single period. Policies usually set a default based on litigation exposure, contracts and employee notices, with longer periods for executives or regulated roles and immediate preservation under any legal hold. Many companies separate business records sent by email from ordinary correspondence so each follows the right rule.
Do digital and paper records follow the same retention periods?
Generally yes. Retention rules usually focus on the content of a record, not its medium, so a scanned invoice follows the same period as the paper copy. For tax, the IRS's Rev. Proc. 98-25 treats machine-sensible records in accounting and ERP systems as records that must be kept at least until the limitations period for each tax year expires. Before destroying originals after scanning, check whether any rule or contract requires the original, and confirm the scans are complete and legible.
Who should own the retention schedule?
Finance or legal usually owns the schedule, with a named business owner for each record type. IT runs the systems and automation, but the head of support, the controller and the HR lead decide what their records need. Review the schedule when laws, systems or the business change.
Can we keep records longer than required?
Usually, unless a privacy law, contract or your own policy limits it. Longer retention of personal data increases breach and discovery exposure and can conflict with minimization rules. Keeping operational content after removing personal details is often the cleaner way to preserve value.
What happens to records if the company is acquired?
The purchase agreement decides. In a stock sale the records stay with the entity; in an asset sale the agreement lists which records transfer and which stay with the seller. The seller may still need to keep the tax and employee records it retained, and may need access rights to transferred ones.
Sources
- The IRS says to keep records until the period of limitations runs out: generally 3 years, 6 years if unreported income exceeds 25% of gross income shown, 7 years for a worthless securities or bad debt deduction, indefinitely if no return or a fraudulent return was filed; employment tax records at least 4 years after the tax is due or paid; property records until the limitations period expires for the year of disposal. Source
- FMCSA guidance says that under 49 CFR 395.8(k)(1) a motor carrier must keep each driver's records of duty status and supporting documents for six months from the date of receipt. Source
- Rev. Proc. 98-25 treats machine-sensible records as records under IRC 6001 that must be retained at a minimum until the period of limitation for assessment expires for each tax year. Source
Related resources
- QuestionDo AI labs buy financial data?
- InsightLender consent before licensing company data: what credit agreements say
- InsightCan dental practices sell their data to AI companies?
- InsightCan law firms sell their data to AI companies?
- SolutionTurn the data your company already creates into a licensing asset
- SolutionEnterprise data: the records of how organizations actually work
See if your company qualifies
A short company assessment. No data uploads are needed.