Document retention policy: the real US periods, not the 7-year myth

Someone just asked whether they can shred the 2019 invoices. If the honest answer is "probably, I think so," you don't have a document retention policy. You have a habit.

A document retention policy is the written rule saying how long each class of record stays, where it lives, and who signs off before anything is destroyed. The record retention schedule is the table inside it: record type, period, legal basis, disposition. Retention is the slice of document management with statute numbers attached.

The periods aren't yours to pick. They belong to whoever can demand the record later: the IRS on tax, the Department of Labor on wages and hours, OSHA on exposure and medical files, the EEOC on hiring decisions. None of them coordinate. One employee's file can carry a one-year clock, a three-year clock and a thirty-year clock at once.

Getting it wrong hurts both ways. Destroy early and you lose the document that would have closed the dispute. Keep everything forever and you pay to store personal data you can no longer justify holding.

The tables are the answer. What follows is what they cannot show you.

Payroll is two rows rather than one. 29 CFR 516.5 gives payroll registers, collective bargaining agreements and employment contracts three years, while 29 CFR 516.6 gives the time cards and wage-rate tables behind them only two, and both sit in the same folder. Most companies keep everything for three and stop thinking about it.

Property records run from the wrong end. The clock starts in the year you dispose of the asset, not the year you bought it, which can put a purchase invoice under a twenty-year obligation.

Personnel records look brief. 29 CFR 1602.14 sets one year, and then a discrimination charge freezes everything relevant until final disposition. The Form I-9 clock under 8 CFR 274a.2 turns on a date that has not happened yet when you fill the form in.

Contracts have no federal retention period of their own. The driver is the term plus your state's statute of limitations, and our guide to types of business contracts covers which agreements those are.

A period nobody can date is a period nobody can enforce. "Three years" means nothing until you name the day it starts, and the triggers differ by agency.

Tax periods run from the filing date, or from the due date when you file early. Wage records under 29 CFR 516.5 run from the last date of entry or the last effective date, so a contract amended in year four starts a fresh clock on the amendment. I-9s run from the later of two dates, one of which hasn't happened yet when you fill the form in. OSHA exposure records run from creation.

"Whichever is later" deserves a rule of its own: calculate both dates and diary the later one.

Two things stop the clock rather than start it. A discrimination charge under 29 CFR 1602.14 freezes everything relevant until final disposition, and a legal hold does the same for litigation or an investigation that is pending or reasonably expected. If you already track obligation dates the way our contract management guide describes, retention dates belong in the same calendar.

Scanning a box doesn't automatically satisfy record retention requirements. Federal law attaches conditions, stricter than most people assume.

Under 15 U.S.C. 7001(d), the ESIGN Act, an electronic record satisfies a legal retention requirement on two conditions: it accurately reflects the original, and it stays accessible for the whole required period in a form capable of accurate reproduction. Both run for the life of the record, not for the day you scanned it. UETA section 12 sets the same test in state law and allows a third party to do the storing.

Read that against a folder of unindexed scans on a drive nobody backs up. Accurate, probably. Accessible in year seven, when the format is obsolete and whoever named the files has left? That condition fails quietly, and it fails in three ordinary ways: a proprietary format nobody licenses any more, an encryption key that left with an administrator, and a naming scheme only its author could read. None of the three announces itself. You find out on the day somebody asks for the file.

SEC Rule 17a-4 goes further for broker-dealers, offering a choice between non-rewriteable storage and a time-stamped audit trail of every change and deletion. Nobody else is bound by it, though an electronic signature audit trail does that job for signed documents.

Choosing storage comes down to narrow questions. Can it hold a document for the longest period in your document retention policy? Can it export in a readable format if you leave? Does it log access and changes? Chaindoc keeps the executed document with its identity check and trail together, and pricing lists the plans.

Not much, and that's the honest answer. No federal retention period in the tables above moved in 2025 or 2026. The IRS figures in Publication 583 are the same three, six, seven and unlimited as ever, and the FLSA, EEOC, OSHA and I-9 periods are unchanged. If your schedule was right in 2024, every period in it is still right.

Enforcement is where the movement is. In December 2021 the SEC fined JPMorgan Securities $125 million, with $75 million more from the CFTC, because employees ran business communications through WhatsApp, texts and personal email that never reached the firm's records. In September 2022 it announced penalties above $1.1 billion across sixteen firms for the same failure. Those are broker-dealer cases, so read the pattern rather than the numbers: what goes missing is what nobody classified.

Which is the practical 2026 question for a document retention policy. The periods held steady. Your schedule probably hasn't kept up with where the work now happens.

Retention law tells you what to keep. Privacy law tells you what to get rid of, and the two reach the same file from opposite ends.

State consumer privacy statutes give residents a right to ask a business to delete personal information held about them. Those laws carry exceptions for information a company must retain under other law, which is why the citation column of a document retention policy earns its place: it's the evidence that a refusal to delete rests on a legal obligation rather than inertia. Without a documented period, "we still need it" is an assertion, and a weak one.

A legal hold cuts the other way. Once litigation, an audit or an investigation is pending or reasonably anticipated, the schedule stops for anything relevant and stays stopped until counsel lifts it. Destroying on schedule during a hold is worse than having no schedule at all.

The destruction record is the part everyone skips. Log the series, the date range, the method, the date and the person who authorized it. When somebody asks in three years what happened to the 2022 files, that log is the answer.

Under ten people, you don't need a records retention program. You need one page. List the six or seven classes you actually hold, put the statutory period beside each, name the person who authorizes destruction, and set an annual reminder to reread it. Ninety minutes, once.

Between ten and a hundred, the failure mode changes. Records now sit in more places than one person can see, and the risk is a category nobody owns. Split payroll from time cards, put the I-9 clock on a calendar instead of in someone's memory, and pick storage that will still open its own files in fifteen years.

Above a hundred, or in any regulated sector, the schedule needs an owner with authority to enforce it, a written legal-hold procedure legal can trigger in an afternoon, and a destruction log somebody reviews.

Whatever the size, build the document retention policy around the citation. A period you can trace to 29 CFR 516.5 or Publication 583 survives an audit. A round number picked because it felt safe doesn't.