Last Updated: October 28, 2026
Quick Summary
A document retention policy must satisfy federal statutes, state rules, and industry regulations at once, and when these conflict you keep the record for the longest applicable period. Every retention period should be tied to a named legal source, and destruction must stop immediately under a legal hold.
- Federal law sets floors, not ceilings, so state and industry rules often require longer retention.
- A working retention schedule needs columns for record category, owner, retention period, legal source, and disposition method.
- Legal holds suspend all destruction and require written notice, acknowledgment tracking, and periodic reissue.
- Log every destruction event with what, when, who, and which schedule line authorized it.
- Name one accountable owner and audit compliance against the schedule at least annually.
Table of Contents
- What Federal and State Laws Require in a Document Retention Policy
- How to Use a Document Retention Policy Template
- Document Retention Periods by Record Type
- Legal Hold and Document Preservation: When Routine Destruction Must Stop
- Building a Document Destruction Policy That Holds Up in Court
- Digital Records, Cloud Storage, and Vendor Responsibilities
- Assigning Ownership, Auditing Compliance, and Reviewing the Policy
- Next Step: Get a Confidential Review of Your Retention Gaps
- Frequently Asked Questions
What Federal and State Laws Require in a Document Retention Policy
A document retention policy is a written rule that tells your organization which records to keep, for how long, and when to destroy them. Requirements come from three layers at once: federal statutes, state rules, and industry regulations. This guide breaks down how those layers interact.
Get this wrong and the consequences are real. Destroy a record during pending litigation and a court can sanction you. Keep nothing and you cannot defend a claim. Keep everything and you drown in storage costs and discovery risk.
Key Federal Statutes That Set Minimum Retention Periods
No single federal law sets one blanket retention period; several statutes each cover a slice of your records:
- Tax records: The IRS generally expects supporting records kept until the period of limitations expires, which is typically three years for most returns and longer in some cases. Check the current IRS guidance on recordkeeping for the rule that fits your situation.
- Employment records: Federal wage and hour rules set minimums for payroll and time records under the Fair Labor Standards Act, administered by the U.S. Department of Labor.
- Workplace safety records: OSHA requires injury and illness logs kept for a set period, detailed on the OSHA recordkeeping page.
- Employee benefits: ERISA imposes retention duties on plan records.
These are floors, not ceilings. A common mistake is treating the federal minimum as the answer.
State and Industry Rules That Override Federal Minimums
State law often sets longer periods than federal law, and industry regulators add their own. When rules conflict, keep the record for the longest applicable period. That single rule resolves most conflicts.
Watch out: a policy built only on federal minimums can violate your state's statute of limitations for contract or fraud claims, which can run years longer.
How to Use a Document Retention Policy Template
A template is a starting point, not a finished policy. The gap most organizations fall into is treating a downloaded template as a compliance document. A defensible policy ties every retention period to a named legal source and documents how conflicts among federal, state, and industry rules are resolved.
Step 1: Build the Schedule Structure
A working retention schedule has at least six columns: record category, description, owner, retention period, legal source, and disposition method. Add a seventh for legal hold status so anyone reading the schedule knows destruction can freeze. Templates that omit the legal source column can make it harder to explain why a period was chosen.
Step 2: Resolve Conflicting Jurisdictions
Federal, state, local, and industry rules often set different periods for the same record type. The practical rule most compliance teams use is: keep the record for the longest applicable period. But that rule only works if you have identified every applicable source. Use this process:
- List the jurisdictions where the organization operates and where employees and customers reside.
- List the industry regulators that apply (for example, the SEC, FINRA, HIPAA-covered entities, or state insurance departments).
- For each record category, identify the federal floor, the minimum period set by federal statute or regulation.
- Identify the state ceiling, the longest period required by any state where the organization does business, including state statute of limitations for contract, fraud, and personal injury claims.
- Identify industry-specific periods that may exceed both.
- Adopt the longest period and document the source in the schedule.
A common pattern is to build the schedule on federal minimums alone, then discover during a dispute that a state statute of limitations runs years longer. The schedule should reflect the longest period, not the most convenient one.
Step 3: Populate the Schedule with Source-Linked Lines
Every line in the schedule should cite its authority. The table below is a sample framework, not legal advice, confirm each period against your own jurisdiction and industry before adoption.
| Record Category | Sample Retention Period | Legal Source to Verify |
|---|---|---|
| Tax returns and supporting records | 3 years from filing, longer in some cases | IRS recordkeeping guidance; state tax statutes |
| Payroll and time records | 3 years | Fair Labor Standards Act regulations |
| Employee personnel files | Duration of employment plus several years | State statutes and statute of limitations |
| Injury and illness logs | 5 years | OSHA recordkeeping rule |
| Contracts | Life of contract plus limitations period | State statute of limitations |
| Corporate minutes and governance records | Permanent | State corporate law and governance needs |
| Litigation files | Until matter closes plus appeal window | Legal hold and counsel direction |
Treat every number in that table as a prompt to check the source. Periods shift, and your state may demand more. Review the schedule at least annually and after any major legal change.
Step 4: Customize for Your Organization
Delete categories you do not create, an empty row invites confusion. Replace every default period with one tied to a named statute, regulation, or documented business need. Route the draft to counsel before adoption, and have the records owner sign off on each line.
Step 5: Document the Approval and Review Trail
A schedule that cannot show who approved it and when is difficult to defend. Keep a version history recording the date of adoption, the approver, the counsel review, and each subsequent revision, evidence that your policy was deliberate, not ad hoc.
The template gets you organized; the source-linked customization and conflict-resolution method make it defensible.
Document Retention Periods by Record Type
Retention periods vary by record type, and the right period is the longest one any law, regulation, or business need requires. Use this as a working framework, then confirm each period against your own jurisdiction:
| Record Type | Typical Minimum | Key Driver |
|---|---|---|
| Tax returns and support | 3-7 years | IRS limitations period |
| Payroll and timesheets | 3 years | FLSA |
| Employee personnel files | Duration of employment plus several years | State law, claims windows |
| Injury and illness logs | 5 years | OSHA |
| Contracts | Life of contract plus limitations period | State statute |
| Corporate minutes | Permanent | Governance |
| Litigation files | Until matter closes plus appeal window | Legal hold |
Treat every number in that table as a prompt to check the source. Periods shift, and your state may demand more.
Legal Hold and Document Preservation: When Routine Destruction Must Stop
A legal hold is a written directive that suspends destruction of records relevant to pending litigation, a government investigation, or a reasonably anticipated dispute. It overrides every line of your retention schedule. The moment a hold issues, routine destruction of covered records must stop, and the burden is on your organization to prove it did.
Courts do not treat a hold as an informal email. Under the Federal Rules of Civil Procedure, parties must preserve relevant information once litigation is reasonably anticipated, and failure can lead to sanctions, adverse inference instructions, or independent spoliation claims. A hold that is issued but not tracked is nearly as dangerous as no hold at all.
The Five Phases of a Defensible Legal Hold
**1.
Start a confidential consultation →
2. Written notice to custodians. Issue the hold in writing to every custodian who may hold relevant records, including departed employees whose files remain in email, chat, or cloud systems.
3. Acknowledgment tracking. Require each custodian to affirmatively acknowledge the hold, and log the date, time, and method.
4. Suspension of auto-deletion. Work with IT and system owners to suspend auto-deletion in email, chat, collaboration platforms, cloud drives, and backup rotation for the scoped custodians and date ranges.
5. Periodic reissue and release. Reissue the hold periodically (many organizations use a 90-day cycle) to remind custodians and capture new employees who join the matter.
Common Legal Hold Failures
- Assuming IT owns the hold. IT can suspend deletion, but it cannot decide scope, notify custodians, or track acknowledgments. Name a hold coordinator in the policy.
- Forgetting departed employees. Their mailboxes and files often remain in backup or archive systems and are still subject to preservation.
- Releasing too early. A hold released before the appeal window closes can result in destruction of records the court later orders produced.
- No link to the retention schedule. The hold should reference the specific schedule lines it suspends so the records owner knows exactly what to stop destroying.
When a hold freezes destruction, questions about how records get investigated and documented tend to follow. Readers can learn how corporate investigations are conducted and documented so preserved records hold up.
Building a Document Destruction Policy That Holds Up in Court
A document destruction policy is only as strong as its documentation. Courts do not punish destruction itself. They punish destruction that looks selective, undocumented, or timed to hide something.
Build these controls in:
- Destroy on a schedule, not on demand.
- Log every destruction event: what, when, who, and under which schedule line.
- Require sign-off from a records owner before any batch destruction.
- Never destroy anything under a legal hold.
Watch out: destroying records after a dispute is reasonably anticipated can trigger adverse inference, where a court assumes the lost records hurt your case.
Digital Records, Cloud Storage, and Vendor Responsibilities
Electronic records follow the same retention rules as paper. The difference is volume and where the records live. Email, chat, cloud drives, and backup tapes all count as business records when they document your operations.
Three practical steps:
- Map where data sits, including SaaS tools and vendor systems.
- Put retention terms in vendor contracts, covering deletion, export, and hold compliance.
- Test retrieval so you know you can produce records on demand.
A common mistake is assuming the vendor owns retention. Readers handling digital records and third-party vendors can find guidance on hiring investigators for internal fraud cases and managing evidence for court. It does not. Your organization remains responsible for records held by third parties.
Assigning Ownership, Auditing Compliance, and Reviewing the Policy
A retention policy without an owner is a document, not a control. Name one accountable person, assign category owners beneath them, and audit against the schedule at least annually.
Your audit should answer:
- Are records being destroyed on schedule?
- Are holds being acknowledged and logged?
- Do new systems and vendors appear in the schedule?
Review the policy yearly and after any major legal change. Audits also surface warning signs early.
Next Step: Get a Confidential Review of Your Retention Gaps
Most retention failures hide in plain sight: a missing hold log, a vendor with no deletion terms, a schedule nobody audits.
Special Solutions, Ltd. has supported attorneys and corporations since 1991. Our investigators document evidence to court expectations, our leadership serves on the Illinois private detective regulatory board, and our teams are prepared to testify when a matter goes to trial. We work discreetly.
Before you engage help, you may want straight answers on cost, reports, and testimony. Start a confidential consultation with Special Solutions, Ltd.
Frequently Asked Questions
What are the legal requirements for a document retention policy?
A document retention policy should identify the rules applicable to the organization and the records it maintains. Because requirements vary, confirm applicable requirements with qualified counsel and official sources.
How long should a business keep its records?
Retention periods vary by record type and applicable requirements. Confirm the appropriate period with qualified counsel and official sources, and document the basis for the schedule.
When should a company suspend routine document destruction?
When a dispute or inquiry may affect records, consult qualified counsel about preservation obligations and document the applicable process in the policy.
Can a business destroy records after the retention period expires?
Whether records may be destroyed depends on the applicable requirements and circumstances. Consult qualified counsel before destroying records that may be relevant to a dispute or inquiry.
