Duration of employment plus five to 10 years—when talking with Zasio’s clients, this range regularly comes up. It’s the standard for retaining employee records based on operational needs and location-specific legal recordkeeping requirements.
If that answers the question you had when you clicked on this article, great! If you want to understand what determines whether a more customized retention period is right for you, keep reading.
- Where you have employees: There is a significant disparity between recordkeeping requirements in different countries or even the states, provinces, and territories within them.
- For example, countries like Croatia, Macedonia, and Slovenia require permanent retention of employee records. In contrast, over 30% of countries don’t specify a generally applicable mandatory minimum period to keep employee records. These include Argentina, Brazil, Greece, Panama, and Slovakia.
Even when countries specify a defined period less than permanent, they can require retention for several years after employment ends. Others allow the period to start after the records are created. Given this, the length of a person’s employment can cause a big difference in how long employment records must be retained.
The United States has federal and state laws regulating how long to keep employee records. The federal requirements aren’t relatively lengthy, so most organizations choose to keep the records based on the longest requirement from the states in which they operate or based on business needs. The common benchmark here is the duration of employment plus five to seven years; however, this can change to as low as three or as high as 10. [i]
- Some industries regulate employee records (and recordkeeping generally) more strictly. For example, the Pennsylvania Insurance Department requires insurers to retain employee records for seven years after termination. If your industry is among the more heavily regulated, there’s a good chance your records are subject to more stringent requirements.
- What you consider an employee record is a factor. Using larger “buckets” or groupings of records can increase the retention period. This is because the more types of records you include, the more likely an individual record will drive up the retention period for the group. For example, Tennessee requires a seven-year retention period for payroll records, so including them may increase the retention period for the rest of your employment records, or it could cause you to retain payroll records for longer if your employment records are already at 10 years.
Some standard records commonly considered employee records are identifying information (like name, birthdate, address, or location) and information about important activities (such as hiring promotion, discipline, termination, and the like). Other optional records (or that could require separation depending on the jurisdiction) may include time and attendance, eligibility, contracts, training and certifications, medical, drug testing, and payroll and wage. Based on risks from the ever-expanding number of privacy laws, more organizations are choosing to break out from employee file records having significantly longer or shorter retention needs to avoid over-retention.
Your operational needs matter. Most privacy requirements tie retention to the purpose of initially collecting the information. This leaves defining the operational need up to the organization collecting the information. Common operational reasons for retaining employee records could include employee performance reviews, resource planning, verifying employment dates and locations after employment ends, responding to regulators, and defending against various types of litigation. But be considerate about privacy requirements. If you are setting your retention based on a valid operational reason extending beyond legal requirements, document that reason as specifically as possible. Also, be sure to first vet any decision with your legal department.
To comply with privacy requirements[ii], many organizations choose to defensibly delete employee records upon satisfying legal requirements and operational needs. Before you start cleaning house, make sure you have a process to ensure conformity.
Deleting employee or any other records without a process (like a records retention schedule, approvals, litigations holds, and process for recording destructions in due course) can risk giving the impression you’re deleting records haphazardly, or worse, nefariously. Check out this Virtual Coffee webinar on defensible disposition to learn how to delete records the defensible way. And for help solving any of your organization’s records and information management (RIM) challenges like researching what recordkeeping requirements are specific to your jurisdictions, Zasio Consulting is here to help!
[i] Federally, 29 CFR 1627.3 (a) requires employers to keep employee records containing identifying information (name, address, birthdate), occupation, and compensation information for three years. Combined with 29 CFR 1602.14 which requires employment records to be kept for one year from records creation or the personnel action involved, whichever occurs, which leads most organizations to a minimum retention of duration of employment plus three years.
[ii] See the broad definition of personal data in article 4 of the GDPR, EU Reg 2016/679 or CCPA, Cal Civ Code 1798.140 as two examples of a long list of privacy laws, that include employee information, most of which are modeled after the GDPR.
Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.