How long should you keep employee records? The answer under US federal rules runs from one year for general personnel files to 30 years for some medical and exposure records. The EEOC sets the floor at one year, the IRS asks for four years on employment tax records, and OSHA’s exposure standard reaches 30 years. Your state may add more.
This guide covers what belongs in a file, what to store apart, how long to keep it, and who should see it.
Key Takeaways – Keep general personnel records at least 1 year (EEOC), payroll records 3 years, and employment tax records 4 years (IRS). – Store medical files, Form I-9s, and payroll data apart from the personnel file. – Apply the longest period that covers each document, then add state rules. – Pause deletion the moment a claim is possible.
What belongs in employee records?
Employee records should hold the documents that show who someone is, what they were hired to do, what they were paid, and how they performed. Federal law doesn’t list the contents, but the EEOC requires employers to keep all personnel or employment records for at least one year, so anything you file should be worth defending.
A sound file covers hiring, pay, performance, and conduct, and nothing that exposes protected personal information to people with no need for it:
- Hiring: application or resume, job description, signed offer letter, employment agreement
- Onboarding: policy acknowledgments, confidentiality agreements, emergency contacts, training sign-offs
- Pay and tax: rate history, raise letters, federal Form W-4
- Performance: reviews, goals, written feedback
- Discipline: warnings, corrective action plans, employee responses
- Separation: resignation or termination notice, exit interview notes, final pay confirmation
Quick test: if a manager with a legitimate reason opened the file, would anything be unrelated to the job? If so, move it.
Which records need separate storage?
Three record types should sit outside the general personnel file: medical files, Form I-9s, and payroll data. The ADA regulations (29 CFR 1630.14) require medical information to be kept “on separate forms and in separate medical files,” and USCIS says paper I-9s must be producible within three business days of an inspection request.
Medical and health information. The ADA section also limits who may be told. Supervisors learn about necessary restrictions and accommodations, first aid and safety staff learn what emergency treatment might require, and ADA investigators can request relevant information. FMLA paperwork follows the same logic: under 29 CFR 825.500, certifications and medical history stay confidential “in separate files/records from the usual personnel files.” Doctor’s notes, accommodation requests, and FMLA certifications all go in a restricted medical file.
Form I-9. Keep I-9s together, sorted into current and former employees. That makes the three-day deadline easy to meet and keeps identity document copies away from managers. USCIS doesn’t require a separate binder, so this is a practice recommendation rather than a legal rule, but most HR teams follow it.
Payroll and tax records. These usually live in the payroll system, because their retention periods and audience (the IRS and the Department of Labor) differ from a performance file’s. Many employers also keep harassment complaints and other investigation files apart. That’s common practice, not a legal requirement.
Separation also works as scoping. When an inspector asks for I-9s, you hand over one folder, not a personnel file full of medical notes and reviews you never meant to share. Wouldn’t you rather do that than sort documents under a three-day clock?
How long should you keep employee records?
No single federal rule says how long to keep an employee file. Instead, several laws each set a minimum for one record type: one year for personnel records (EEOC), three years for payroll (FLSA and ADEA), and at least four years for employment tax records (IRS). Keep each document for the longest period that applies.
Record type
Minimum retention
Source
General personnel and employment records
1 year; for involuntary terminations, 1 year from the termination date
EEOC
Payroll records
3 years
FLSA (DOL) and ADEA (EEOC)
Records behind wage calculations (time cards, rate tables, schedules, pay additions and deductions)
2 years
FLSA (DOL)
Employment tax records, including Forms W-4
4 years after filing the fourth quarter return for the year
IRS
Form I-9
3 years after date of hire, or 1 year after employment ends, whichever is later
USCIS
FMLA records
3 years
29 CFR 825.500
Benefit plan and seniority or merit system records
Full period the plan or system is in effect, plus at least 1 year after it ends
ADEA (EEOC)
Records relevant to a discrimination charge or lawsuit
Until final disposition of the charge or lawsuit
EEOC
Employee medical records (where OSHA’s exposure standard applies)
Length of employment plus 30 years
OSHA 29 CFR 1910.1020
Employee exposure records (toxic substances, harmful agents)
30 years
OSHA 29 CFR 1910.1020
The EEOC’s one-year rule is a floor. Once a charge of discrimination is filed, keep every relevant record, including records about similar employees, until the charge or any lawsuit is finally resolved. Any deletion schedule needs an off switch for pending claims.
Payroll and tax clocks differ. The DOL’s FLSA fact sheet sets three years for payroll records and two for the time cards and rate tables behind wage computations, so many employers simply keep both for three years. The IRS says to keep employment tax records at least four years after filing the fourth quarter return for the year, and at least six years for qualified sick and family leave wages and employee retention credit wages.
OSHA’s 30-year rule is narrow. It covers medical and exposure records for employees exposed to toxic substances or harmful agents. Most offices rarely trigger it. Manufacturers, labs, and construction firms often do.
State law can extend all of this. California requires employers to keep personnel records for at least three years after termination (Labor Code section 1198.5). Many employers also adopt one three-to-seven-year schedule after separation. That’s a risk-management choice, not a federal mandate, so have counsel confirm it.
Here’s the catch with a single schedule: the clocks start at different moments. The I-9 runs from hire or exit, and tax records from the fourth-quarter filing, which can land months after someone’s last day. A flat “years since exit” rule must outlast every clock that applies to you.
Is digital or paper storage safer?
For most small and mid-size employers, digital storage is easier to protect and to search. The rules care whether a record is accurate, complete, and retrievable, not what it sits on. OSHA’s medical record rule alone can run employment plus 30 years, which is a long time to trust a filing cabinet.
USCIS explicitly allows I-9s on paper, on microfilm, or electronically. Digital storage adds three advantages:
1 Access logs: you can see who opened a file and when.
2 Role-based permissions: managers see team performance history without salary or medical notes.
3 Retention reminders: records get flagged for review when their period ends.
Paper still works if you lock it and log who opens the cabinet. The usual failure is a hybrid: some documents in a drawer, some in email, some on a shared drive. Pick one system of record per document type.
HR systems like HR Partner centralize employee records with permission controls, so medical and payroll data can be kept apart from the general file without running several tools. Whatever you choose, check that it restricts access by role and can export a complete file on request.
Who can access employee records?
Access should follow a need-to-know rule applied by role, and employees often have a legal right to see their own file. In California, Labor Code section 1198.5 lets current and former employees inspect and copy records about their performance or any grievance, with a 30-calendar-day deadline after a written request.
A simple access model looks like this:
- HR: full access, with tighter permissions for medical and investigation files
- Managers: performance, job history, and conduct records for their own reports only
- Payroll and finance: pay, tax, and banking data, not performance or medical files
- The employee: often entitled to their own file, depending on the state
Access rights come mostly from state law, with different deadlines and scope in each, so confirm yours before you build a request process.
Frequently asked questions
How long should you keep employee records after termination?
At minimum, one year for general personnel records (EEOC), three years for payroll and FMLA records, and four years for employment tax records (IRS). The I-9 follows the later of three years from hire or one year after employment ends. A single longer schedule is a policy choice, not a federal rule.
Should medical information go in the personnel file?
No. The ADA regulations (29 CFR 1630.14) require medical information to be kept “on separate forms and in separate medical files,” and FMLA rules (29 CFR 825.500) require certifications to stay in separate files. FMLA records also carry a three-year minimum retention.
Can employees request a copy of their personnel file?
It depends on the state. California gives current and former employees the right to inspect and copy certain records, with a 30-calendar-day deadline after a written request (Labor Code section 1198.5). Other states set different deadlines and scope.
What should a retention checklist include?
A workable retention process has six steps, and the first is separating file types. With federal minimums spanning one year (EEOC) to 30 years (OSHA), one blanket schedule rarely fits every document. Use this checklist to build one that does.
1 Separate file types: personnel, medical, I-9, payroll, and investigations.
2 Assign each type an owner and a retention period from the table above.
3 Add your state’s rules and extend any period where state law is longer.
4 Set a legal hold process that pauses deletion when a claim is possible.
5 Review access permissions yearly, especially after role changes.
6 Destroy records securely once the period ends, and log the destruction.
This article is general information, not legal advice. Retention rules change and vary by state, industry, and employer size, so have employment counsel review your schedule before you adopt it.
