• Jurisdiction official name: United Mexican States (Estados Unidos Mexicanos).
• Legal system type: Civil law system with a federal structure, codified statutes, and limited binding precedent based on consistent higher-court rulings.
• Primary language(s) of law/government: Spanish
• General Description of RIM landscape: Mexico’s recordkeeping framework is driven by federal obligations covering tax documentation, accounting books, payroll and employment files, social security records, and regulated industry reporting. Key requirements arise under the Commercial Code, Federal Tax Code, Federal Labor Law, Social Security Law, and sector-specific regulations. Mexico’s privacy regime also affects retention and disposal practices where personal data is involved, particularly for employee and consumer information.

Zasio Research Scope & Depth

Total Zasio citations captured: 817

Primary sources relied upon:

• Code of Commerce
• Federal Fiscal Code
• Federal Labor Law
• Social Security Law
• Federal Law on the Protection of Personal Data Held by Private Parties

Core Recordkeeping Obligations

• How long must businesses keep accounting records? Generally, 10 years (Code of Commerce)
• How long must employers keep personnel records? Generally, at least until employee termination plus 5 years (combination of the Federal Labor Law and Social Security Law).
• Industries most heavily regulated:
  • Financial services and banking
  • Energy (oil, gas, electricity)
  • Pharmaceuticals, medical devices, and health services
  • Manufacturing and cross-border trade, which face customs

Other notable retention timeframes:

• • Customs records: 5 years
  • AML/CFT records: 5 years from the date of the relevant transaction.
  • Personal data: Delete once it is no longer needed for its original purpose.
  • Corporate constitutive acts, capital changes, mergers, and spin-offs: for the life of the entity.

Mexico is one of the world’s most advanced adopters of continuous transaction controls (CTCs) and real-time electronic tax reporting. Most taxable business transactions, including payroll, invoices, credit notes, and many transportation and export documents, must be generated as structured XML records. In practice, this means the Mexican tax authority has near-immediate visibility into commercial activity across the economy.

Mexico is the United States’ largest goods trading partner and a critical manufacturing and nearshoring hub for North America. Also, the 2025 data protection reform (new authority, expanded retention and deletion obligations, new specialized federal courts), and a labor framework with strong employee-favorable presumptions when records are missing.

Impacted Organizations

• Multinational manufacturers and with Mexican operations and U.S./Canadian supply chains.
• Retailers, e-commerce, and B2C companies.
• Financial services.
• Businesses processing personal data of Mexican residents, including foreign controllers using means located in Mexico.

Zasio’s Mexico research gives records, privacy, and compliance teams a defensible basis for retention schedules that reconcile the 10-year commercial standard, the 5-year tax standard, employment-relationship-based labor retention, and data protection requirements.

Mexico recently restructured its data protection enforcement framework by moving oversight authority into the executive branch and assigning dispute review to specialized federal courts, creating ongoing uncertainty as enforcement practices, regulatory guidance, and compliance expectations continue to evolve.

Article 320 of Mexico’s Federal Labor Law requires employers using home-based production workers to maintain a labor-authorized worker register with prescribed employment and wage information that must remain permanently available (ongoing availability, not permanent retention) for labor inspection upon request. The applies to genuine home-based production and piecework arrangements, not ordinary remote office work, which is governed separately under Mexico’s telework rules.

Disclaimer: The purpose of this post is to provide general education on records management solutions. The statements are informational only and do not constitute legal advice. Any references to legal or regulatory recordkeeping requirements are provided for general guidance purposes and may not reflect all obligations applicable to your organization. Additional or alternative requirements may apply based on your organization’s industry, jurisdiction, risk profile, and specific business activities. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Mexico Records Retention Requirements appeared first on Zasio.

If that answers the question you had when you clicked on this article, great! If you want to understand what determines whether a more customized retention period is right for you, keep reading.

• Where you have employees: There is a significant disparity between recordkeeping requirements in different countries or even the states, provinces, and territories within them.
• For example, countries like Croatia, Macedonia, and Slovenia require permanent retention of employee records. In contrast, over 30% of countries don’t specify a generally applicable mandatory minimum period to keep employee records. These include Argentina, Brazil, Greece, Panama, and Slovakia.

Even when countries specify a defined period less than permanent, they can require retention for several years after employment ends. Others allow the period to start after the records are created. Given this, the length of a person’s employment can cause a big difference in how long employment records must be retained.

The United States has federal and state laws regulating how long to keep employee records. The federal requirements aren’t relatively lengthy, so most organizations choose to keep the records based on the longest requirement from the states in which they operate or based on business needs. The common benchmark here is the duration of employment plus five to seven years; however, this can change to as low as three or as high as 10. [i]

• Some industries regulate employee records (and recordkeeping generally) more strictly. For example, the Pennsylvania Insurance Department requires insurers to retain employee records for seven years after termination. If your industry is among the more heavily regulated, there’s a good chance your records are subject to more stringent requirements.
• What you consider an employee record is a factor. Using larger “buckets” or groupings of records can increase the retention period. This is because the more types of records you include, the more likely an individual record will drive up the retention period for the group. For example, Tennessee requires a seven-year retention period for payroll records, so including them may increase the retention period for the rest of your employment records, or it could cause you to retain payroll records for longer if your employment records are already at 10 years.

Some standard records commonly considered employee records are identifying information (like name, birthdate, address, or location) and information about important activities (such as hiring promotion, discipline, termination, and the like). Other optional records (or that could require separation depending on the jurisdiction) may include time and attendance, eligibility, contracts, training and certifications, medical, drug testing, and payroll and wage. Based on risks from the ever-expanding number of privacy laws, more organizations are choosing to break out from employee file records having significantly longer or shorter retention needs to avoid over-retention.

Your operational needs matter. Most privacy requirements tie retention to the purpose of initially collecting the information. This leaves defining the operational need up to the organization collecting the information. Common operational reasons for retaining employee records could include employee performance reviews, resource planning, verifying employment dates and locations after employment ends, responding to regulators, and defending against various types of litigation. But be considerate about privacy requirements. If you are setting your retention based on a valid operational reason extending beyond legal requirements, document that reason as specifically as possible. Also, be sure to first vet any decision with your legal department.

To comply with privacy requirements[ii], many organizations choose to defensibly delete employee records upon satisfying legal requirements and operational needs. Before you start cleaning house, make sure you have a process to ensure conformity.

Deleting employee or any other records without a process (like a records retention schedule, approvals, litigations holds, and process for recording destructions in due course) can risk giving the impression you’re deleting records haphazardly, or worse, nefariously. Check out this Virtual Coffee webinar on defensible disposition to learn how to delete records the defensible way. And for help solving any of your organization’s records and information management (RIM) challenges like researching what recordkeeping requirements are specific to your jurisdictions, Zasio Consulting is here to help!

[i] Federally, 29 CFR 1627.3 (a) requires employers to keep employee records containing identifying information (name, address, birthdate), occupation, and compensation information for three years. Combined with 29 CFR 1602.14 which requires employment records to be kept for one year from records creation or the personnel action involved, whichever occurs, which leads most organizations to a minimum retention of duration of employment plus three years.

[ii] See the broad definition of personal data in article 4 of the GDPR, EU Reg 2016/679 or CCPA, Cal Civ Code 1798.140 as two examples of a long list of privacy laws, that include employee information, most of which are modeled after the GDPR.

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post How Long to Keep Employee Records – Seems Like an Easy Question, Right? appeared first on Zasio.

Author: Jared Walker, JD

Senior Research Analyst, Team Lead / Licensed Attorney

The post International Tax Record Retention Period by Country appeared first on Zasio.