What Is a Retention Period in a Legal Context? Records, Rules, and Examples
A retention period is the length of time a person or organization must—or chooses to—keep a record, document, or piece of information. In a legal context, the applicable period depends on the type of record, the organization, the governing law, and whether a dispute or investigation is underway. Knowing the difference between a legal retention requirement, a company policy, and a deadline for filing a lawsuit can help prevent costly mistakes.
What Does “Retention Period” Mean in Law?
A retention period is a defined span of time during which a record must be preserved and remain accessible. The requirement may come from a federal or state law, a regulation, a court order, a contract, or an organization’s own records-management policy. It may specify a minimum period, a maximum period, or conditions for keeping and disposing of information.
The term does not have one universal legal meaning or one standard duration. For example, a tax record, an employee file, a medical record, and a business email may be covered by different rules. Some rules apply only to particular industries or types of organizations; others vary by state or by the circumstances in which a record was created.
A retention rule may also require more than simply keeping a document in a box or on a server. Records may need to be secure, readable, retrievable, and protected from unauthorized alteration. Electronic records can count as business records, so a digital format does not automatically remove legal responsibilities.
Retention Periods Are Not the Same as Lawsuit Deadlines
One common source of confusion is the difference between a record-retention period and a statute of limitations. A retention period concerns how long information should or must be preserved. A statute of limitations generally sets the time limit for bringing a particular legal claim. These timelines serve different purposes and do not automatically match.
For instance, a business may be required to keep a particular record for a specified period while a potential claim involving that record could have a different filing deadline. The limitation period may depend on the type of claim, the jurisdiction, when the claim accrued, and other legal rules. Special circumstances can affect deadlines, too.
Therefore, a business should not assume it can destroy a record as soon as a typical lawsuit deadline passes. Nor should it assume that keeping every record indefinitely is the safest choice. Legal duties, privacy rules, storage risks, and litigation concerns all matter.
What Determines How Long Records Must Be Kept?
The correct retention period usually depends on several overlapping factors. A compliance program should identify each factor rather than applying one blanket schedule to every document.
- Record type: Tax returns, payroll records, contracts, safety logs, medical charts, and emails may have different rules.
- Industry: Financial services, health care, education, and government operations may face specialized requirements.
- Jurisdiction: Federal, state, local, and sometimes foreign rules can apply to the same organization.
- Purpose and status: A draft, a final record, and a record supporting a regulated transaction may be treated differently.
- Legal events: An audit, subpoena, investigation, claim, or reasonably anticipated lawsuit may require preservation beyond the routine schedule.
- Contracts and policy: Agreements or internal rules may impose additional obligations, although they cannot override applicable law.
When requirements overlap, organizations commonly identify the longest applicable retention requirement for the record category, then separately account for legal holds and other preservation duties. The analysis should be documented and reviewed by qualified counsel when the stakes or rules are complex.
Examples of U.S. Record-Retention Requirements
The examples below illustrate why there is no single retention period for all legal records. They are general summaries, not a complete compliance checklist. Requirements can depend on the record, the employer or organization, and the specific law involved.
| Record category | Example of a federal rule | Important limitation |
|---|---|---|
| Employment records | The Equal Employment Opportunity Commission’s regulations generally require covered employers to retain specified personnel and employment records for one year. Certain payroll records under the Fair Labor Standards Act generally must be kept for three years, while records supporting wage computations generally must be kept for two years. | Different statutes cover different records, and longer periods may apply to particular claims, government contractors, or state laws. |
| Tax records | The IRS generally advises keeping records supporting a tax return until the period of limitations for that return expires. Its guidance describes common periods of three or six years in specified circumstances and notes that some records should be retained longer or indefinitely. | The period depends on the tax issue and facts. IRS guidance is not a universal rule for every business record. |
| Health information | HIPAA’s Privacy Rule does not establish a general medical-record retention period for all covered entities. | State law, other federal requirements, licensing rules, and organizational circumstances may set the applicable period. |
| Public federal records | Federal agencies manage records under federal records laws and schedules approved through the National Archives and Records Administration (NARA). | Federal agency schedules do not automatically govern private companies or state and local governments. |
For employment records, the EEOC’s rules include exceptions and different treatment for certain records and situations. For example, records related to an unresolved discrimination charge may need to be preserved until final disposition. Employers should check the governing regulation and any applicable state or local requirements rather than relying on a simplified summary.
The IRS publishes practical recordkeeping guidance, including examples of how the limitation period can change when income is omitted, a refund is claimed, or a return is not filed. Businesses may also have accounting, corporate, contractual, or industry-specific reasons to retain documents beyond the period relevant to a tax return.
In health care, federal HIPAA requirements concerning privacy and security should not be mistaken for a universal rule about how long every patient chart must be kept. State medical-record laws and other rules can establish retention periods, and those rules may differ by provider type or record category.
How a Legal Hold Changes the Normal Schedule
A legal hold, sometimes called a litigation hold, is an instruction to preserve relevant information because litigation, an investigation, or another legal matter is pending or reasonably anticipated. It can pause routine deletion or destruction for the records and data within its scope.
In federal civil litigation, Rule 37(e) of the Federal Rules of Civil Procedure addresses electronically stored information that should have been preserved in anticipation or conduct of litigation but was lost because reasonable steps were not taken. Depending on the circumstances and resulting prejudice, a court may order measures to address the loss; more severe remedies are available under the rule when it finds intent to deprive another party of the information’s use.
A legal hold is not limited to paper files. Relevant information may include email, text messages, cloud documents, collaboration platforms, business-device data, and records held by third-party providers. The organization should identify likely custodians and systems, communicate preservation instructions, and take reasonable steps to suspend automatic deletion where necessary.
A hold does not necessarily mean every record must be preserved forever. Once the matter is resolved and counsel determines that the preservation duty has ended, records can return to the ordinary retention schedule, subject to any other applicable requirements. The release of a hold should be documented.
What Happens When Records Are Destroyed Too Early?
Destroying records before a required period ends can lead to regulatory penalties, adverse audit findings, difficulty proving compliance, or problems responding to a claim. The consequences depend on the governing law and the circumstances. An organization may also face practical harm if it cannot support a tax position, explain a business decision, or establish what happened during a transaction.
Destruction after a preservation duty arises can create additional litigation risk. A court may consider whether information was lost, whether reasonable preservation steps were taken, whether another party was prejudiced, and whether the loss was intentional. The result is not automatic; it depends on the facts and applicable rules.
Keeping records for too long has risks as well. Unnecessary personal or sensitive information can increase exposure in a data breach, complicate privacy compliance, and raise storage and discovery costs. A defensible program therefore sets a clear retention period and a consistent method for secure disposal when that period ends and no hold applies.
How to Set a Practical Retention Policy
A useful retention policy translates legal requirements into everyday procedures. It should be specific enough that employees can determine what to keep, where to keep it, and when ordinary disposal is allowed.
- Inventory records. Identify record categories, including paper files, electronic documents, messages, databases, and records managed by vendors.
- Identify applicable rules. Review federal, state, local, industry, contract, and organizational requirements for each category.
- Set a period and starting point. Specify how long each category is retained and when the clock begins, such as the date of a transaction, the end of a tax year, or an employee’s departure.
- Define ownership and access. Assign responsibility for maintaining records and limit access to people with a legitimate need.
- Build in legal holds. Establish a process to pause destruction when a claim, investigation, audit, or other preservation obligation arises.
- Dispose securely. Use methods appropriate to the medium and sensitivity, and document destruction when required by policy or law.
- Review regularly. Update the schedule when laws, systems, business practices, or organizational responsibilities change.
Organizations often use a records-retention schedule that maps categories to periods and identifies the authority or business reason behind each rule. A schedule should also explain how it handles duplicates, backups, archived data, and records held by service providers. These details matter because routine technology settings may delete or overwrite information automatically.
Questions to Ask Before Deleting a Record
Before deleting or destroying a record, a person responsible for compliance or records management can ask:
- What type of record is it, and which retention schedule applies?
- Does a federal, state, local, industry, or contractual rule require a longer period?
- Is the record connected to an audit, investigation, claim, subpoena, or anticipated legal dispute?
- Is a legal hold currently in effect, and does it cover this person, system, or record category?
- Can the information be disposed of securely without affecting records that must be retained?
If the answers are unclear, deletion should be paused while the applicable requirements are checked. Legal counsel or a qualified records-management professional can help resolve conflicts and determine whether a preservation obligation applies.
Finding Reliable Retention Guidance
Retention requirements should be checked against primary sources whenever possible. Relevant sources may include the text of a federal statute or regulation, state statutes and agency rules, court orders, and the official guidance of the agency responsible for enforcement. For federal rules, the Electronic Code of Federal Regulations and the U.S. Code provide authoritative legal texts; agency pages can explain how those rules are applied.
Useful starting points include the EEOC recordkeeping regulations, the Department of Labor’s FLSA recordkeeping fact sheet, the IRS recordkeeping guidance, the Department of Health and Human Services’ HIPAA FAQ, and Federal Rule of Civil Procedure 37. These sources address different subjects and do not replace a review of applicable state or industry rules.
In short, a legal retention period is not simply a number of years attached to every document. It is a record-specific requirement shaped by law, business context, and legal events. A reliable schedule, secure disposal process, and prompt legal-hold procedure help organizations preserve what they must—and avoid keeping sensitive information longer than necessary.