Part of managing and operating a small business means sorting through hundreds, if not thousands, of physical and electronic documents and records. While staying organized requires clearing out clutter, tossing out the wrong document or deleting an important email can have disastrous consequences.

Without a clear system for document retention, businesses risk losing critical information, or worse, accidentally destroying something they are legally required to keep. On the other hand, holding onto everything indefinitely can waste time, money, and space. A well-crafted document retention policy (DRP) ensures that you keep what is necessary, discard what is not, and can easily find the information you need when you need it.

A DRP is a systematic approach for identifying which documents your business needs to keep and for how long. This applies to both physical and electronic records. A DRP helps businesses in three main ways:

1. Business Efficiency: Reduces clutter, frees up space, and makes it easier to locate important documents quickly.
2. Protection in Litigation: Having the right documents can make or break your case in a lawsuit. Intentional destruction of documents relevant to pending or future litigation can severely undermine your business’s position in litigation.
3. Compliance with Laws and Regulations: Many federal, state, and local laws require you to keep certain records, such as tax or employment documents, for specific periods of time.

 
Some common document categories in a DRP include employee records, training manuals, workplace safety records, accounting and tax records, legal records, and electronic records.

• Employee Records: Keep employee files for the duration of employment, and then for an additional amount of time in the event an employee files a lawsuit. Many DRPs retain employee documents for at least five years after an employee is terminated to cover any potential claims that might arise after an employee leaves. Employee records can include job applications and contracts, performance reviews and disciplinary actions, timesheets and payroll records, as well as benefits and training information. For more information visit U.S. Equal Employment Opportunity Commission – Recordkeeping Requirements and U.S. Department of Labor – Recordkeeping and Reporting. Employers should be advised that each individual state may have different, or additional, time requirements.
• Employment Tax Records: Maintain records of employee wages, identifying information, reported tips, Form W-2s and W-4s, and related documents. The IRS requires employment tax records be kept for at least four years after the due date of the tax return – Employment Tax Recordkeeping.
• Workplace and Safety Records: This includes records of safety training, maintenance records, and product manuals. Generally, these types of documents are kept for around five years in case of a workplace injury, lawsuit, or inspection.
• Accounting and Tax Records: The IRS has specific recordkeeping requirements for gross income, deductions, and credits, including tax returns, gross receipts that show the income you receive from your business, expense reports, and any supporting documentation. Federal tax returns should be kept permanently. For more information visit IRS Publication 583. State departments of revenue may have different or additional requirements.
• Legal Records: This includes real estate records, contracts, intellectual property (patents, trademarks, copyright), administrative penalties, prior lawsuit materials, insurance policies, licenses and permits, government paperwork, and vehicle registration. To the extent possible, these documents should be retained indefinitely because they can be the difference between winning and losing a claim.
• Electronic Records: It is important to not overlook digital data, such as emails, hard drives and backups, web pages, and digital media (photographs, audio recordings, promotional materials). You may need to consult your IT department or an IT professional to ensure electronic data is maintained consistently.

 
How Long Should You Keep Documents?

Retention periods vary depending on the type of document and applicable legal requirements. Certain federal, state, and local requirements mandate that businesses keep documents for a specific number of years. Business owners should also consider potential uses of documents—documents that could support or disprove a legal claim are worth retaining longer. Tax records that verify deductions and expenses should be kept in case of an audit by the IRS or your state tax agency. In addition, detailed records can serve future business needs, such as supporting expansion, attracting investors, or facilitating the sale of your business. Whenever possible, store documents electronically to save space, but remember that some originals, such as contracts with original signatures, should also be kept in their physical form.

How to Store and Protect Your Records

Where and how you store documents depends on your business’s size, space, and budget. While backing up electronic documents is inexpensive, if your business produces a large volume of paper records, you may consider using an offsite storage space. The most recent and active records should be kept onsite and be easily accessible. Files with sensitive information—contracts, employment documents, employee medical records, bank records—should be inaccessible to the general workforce. The Cybersecurity & Infrastructure Security Agency (CISA) offers a list of Good Security Habits.

How to Properly Destroy Documents

Once the retention period expires, documents should be destroyed using a method that renders them unreadable, like shredding, to protect sensitive material. For electronic documents, deleting the file and emptying the digital recycling bin is generally suitable. When destroying sensitive electronic data, it is important to remember that these files are often stored in multiple locations (e.g. hard drives, servers, email accounts). This makes it especially important not to sell old computers or hard drives to unknown individuals before consulting an IT professional or using a data wiping service.

By carefully considering the documents your business produces and the relevant requirements, you should be able to develop a DRP that facilitates your business’s operation and protects you in the event of a legal dispute. Keep in mind that there may be situations where it is better to retain a document regardless of whether you have a legal obligation to do so. In the end, a DRP isn’t just about keeping records—it’s about keeping your business protected and prepared for the future.

If you are unsure what to keep and what to destroy, an accountant, lawyer, or your state recordkeeping agency may provide guidance. For further questions, you can contact the Legal Center at info@nfib.org.