How long to keep business records: keep, destroy or license

How long to keep business records: the retention schedule

Before you shred or delete anything, check what the company's records are worth. AI developers now pay for the operational records of closing and closed companies, such as support tickets, work orders, email and chat archives and code (public deals). A free valuation takes six questions about the business and no files.

Federal agencies set most of the minimums. The table lists them by record type, with the rule each one comes from. Where two rules cover the same record, keep it for the longer period, and add your state's rules, which can be longer. Copy the rows into your own schedule; the template further down shows the columns.

Source: IRS: How long should I keep records?

How long to keep business records after closing a business

Closing the company does not shorten any of these periods. Each clock runs from an event such as a filing, a tax payment or the end of employment, so the last records a closing business creates, such as its final returns and final payroll, are the last ones it can discard. When records are no longer needed for tax purposes, check whether your insurance company or creditors require them to be kept longer (IRS).

• Name a custodian. With the final Form 941 or 944, attach a statement showing the name of the person keeping the payroll records and the address where those records will be kept (IRS).
• Plan for claims after dissolution. A dissolved Delaware corporation continues for 3 years, or longer if the Court of Chancery directs, to prosecute and defend suits and to wind up its affairs (Delaware Code section 278). Keep the records you would need to answer a claim for at least that long.
• Disputes override the schedule. Once an EEOC charge is filed, keep the related personnel records until the final disposition of the charge or any lawsuit based on it (EEOC). In federal court, if electronically stored information that should have been preserved in anticipation of litigation is lost because reasonable steps were not taken, the court can order measures to cure the prejudice and, where a party meant to deprive the other side of it, presume it was unfavorable (FRCP 37(e)).
• Record where everything is. Put the custodian, the storage location and the destruction dates in the company's final minutes or wind-down file, and give a copy to your accountant.
• The state steps are in the closing checklist, how to dissolve a corporation and how to dissolve an LLC.

Source: IRS: Closing a business

How long to keep tax records for a business

The IRS ties each record to the return it supports. Keep the records that support an item of income, deduction or credit until the period of limitations for that return runs out: the time in which you can amend the return to claim a credit or refund, or the IRS can assess more tax. The years count from the date the return was filed, and a return filed before its due date is treated as filed on the due date (IRS).

• 3 years: the standard period, when none of the cases below applies.
• 3 years from filing or 2 years from paying the tax, whichever is later: if you file a claim for credit or refund after you file the return.
• 6 years: if you do not report income that you should report and it is more than 25% of the gross income shown on the return.
• 7 years: if you claim a loss from worthless securities or a bad debt deduction.
• Indefinitely: if you do not file a return, or file a fraudulent one.
• Property: until the period of limitations ends for the year you dispose of it, because the records are needed to figure depreciation and the gain or loss on the sale.
• Keep copies of the filed returns themselves. The IRS notes they help in preparing future returns and in making computations for an amended return.
• Worked example: if the final return's due date is April 15, 2027 and you file it early, the standard 3 years run from April 15, 2027, so its supporting records can go no earlier than April 15, 2030, and only if no longer period applies.

Source: IRS: How long should I keep records?

How long to keep payroll and employee records

Four federal agencies set overlapping rules for employee records, and the longest one wins. For payroll that is usually the IRS: employment tax records must be kept for at least 4 years, which outlasts the 3 years the wage-and-hour rules require.

• Payroll. The Fair Labor Standards Act requires payroll records for 3 years and the records wages are computed from, such as time cards and wage rate tables, for 2 years (DOL). The IRS list of employment tax records includes the amounts and dates of all wage payments, employees' names, addresses, Social Security numbers and occupations, withholding certificates such as Form W-4, and the dates and amounts of tax deposits (IRS).
• Personnel files. Keep all personnel or employment records for 1 year, and for 1 year from the date of an involuntary termination. Under the Age Discrimination in Employment Act, employers must also keep payroll records for 3 years (EEOC).
• Form I-9. Count from the last day of work. For someone who worked less than two years, keep the form 3 years after the first day of employment; for someone who worked more than two years, 1 year after they stopped working. Paper, microfilm, microfiche and electronic storage are all allowed, and the form is never mailed to USCIS (USCIS).
• Injury and illness logs. Keep OSHA 300 Logs and 301 reports for 5 years after the year they cover, and update stored 300 Logs if newly discovered recordable cases come to light during that time (OSHA).
• Benefit plans. Keep plan documents for as long as the plan is in effect and at least 1 year after it ends (EEOC), and the records behind ERISA reports for at least 6 years after filing (ERISA section 107).
• Any consumer reports the company obtained, and records derived from them, fall under the FTC Disposal Rule when you destroy them; see the destruction section below.

Source: EEOC: Recordkeeping requirements

Record retention policy: how to build a retention schedule

A retention policy says which records the company keeps, for how long, who looks after them and how they are destroyed. The retention schedule is the table that puts it into practice. Five steps:

The template below is ready to copy into a spreadsheet. Replace the example rows with your own record series, and keep the schedule with the company's closing file.

• List record series, not individual files: payroll registers, personnel files, Forms I-9, tax workpapers, contracts, minutes, support tickets, chat and email. The data inventory template gives columns for the systems that hold them.
• Note the event that starts each clock: the filing or due date of a return, the end of employment, the end of a contract. Periods run from events, not from the date a record was created.
• Apply the longest rule that covers the record: federal (the table above), state, and any contract, insurer or lender requirement (IRS).
• Name a custodian and a storage location for each series, including after the company closes.
• Write down the destruction method and a legal hold step that stops destruction when a claim, charge or lawsuit is expected.

Source: IRS: How long should I keep records?

Document destruction: how to destroy business records securely

Destruction is the last line of the schedule, and federal rules set the standard for the most sensitive records.

• Consumer report information. The FTC Disposal Rule applies to anyone who keeps consumer information for a business purpose: any record about an individual that is a consumer report or is derived from one. It requires reasonable measures against unauthorized access in disposal, and its examples are burning, pulverizing or shredding papers, and destroying or erasing electronic media, so the information cannot practicably be read or reconstructed (16 CFR Part 682).
• Old computers count. Under the same rule, disposal includes the sale, donation or transfer of any medium, including computer equipment, on which consumer information is stored (16 CFR 682.1). Wipe or destroy drives before laptops and servers are sold in a liquidation.
• Health information. HIPAA requires safeguards through disposal. HHS gives shredding, burning, pulping or pulverizing paper, and clearing, purging or destroying electronic media, as examples, and says covered entities may not abandon protected health information or put it in dumpsters accessible to the public (HHS).
• Electronic media. NIST SP 800-88 Rev. 2, published in September 2025, helps organizations set up a media sanitization program with techniques and controls matched to the sensitivity of their information (NIST). HHS points to the same publication for health records.
• Disputes first. Do not destroy anything tied to an open or expected claim, charge or lawsuit (EEOC; FRCP 37(e)).

Source: eCFR: 16 CFR Part 682, FTC Disposal Rule (disposal of consumer report information)

Choosing a document destruction company

The FTC Disposal Rule lets a business hire a company engaged in record destruction, after due diligence, and then monitor its compliance (16 CFR 682.3). The rule's own examples of due diligence make a working checklist:

Source: eCFR: 16 CFR Part 682, FTC Disposal Rule (disposal of consumer report information)

Before you shred or delete company systems, check what the records are worth

A retention schedule says what you must keep and when you may destroy it. It does not say what a record is worth. Some of what a closing company would shred, wipe or cancel, such as support tickets, work orders, project files, email and chat archives and code, can be licensed to AI developers once personal data is handled. AI labs are buying data from dead startups to train their models, MIT Technology Review reported in October 2026.

Checking the value takes minutes: see what your company's records are worth from six questions about the business, before anything is shredded, wiped or cancelled.

• Export before you cancel. Exporting company records before closing covers the workspace, chat, ticketing and code exports and what each vendor deletes after cancellation.
• Handle personal data first. Suppliers employ data scientists to scrub personally identifiable information and exclude HR records, according to MIT Technology Review. See how to de-identify company data.
• A licence covers a copy. Licensing a de-identified copy of the records does not end the duty to keep the originals for the periods above.

Source: MIT Technology Review: AI labs buying data from dead startups (Oct 2026)

Keep, destroy or license: record by record

Most records fall into one of four groups. Sort them before the systems are cancelled, not after.

Medical, dental and veterinary practice records

Selling a practice rather than closing it? See dental and medical practice valuation for how practices are priced and how patient records move in a sale.

Patient records follow their own rules. The HIPAA Privacy Rule does not include medical record retention requirements; state laws generally govern how long records are kept, and HIPAA requires safeguards for as long as they are kept, including through disposal (HHS). HIPAA's own documentation, such as written policies and procedures, must be kept for 6 years from its creation or the date it was last in effect, whichever is later (45 CFR 164.530(j)).

A practice that is winding up may wish to give patients the chance to pick up their records before any disposition, HHS suggests, and notes that many states require records to be retained and made available for a limited time after a business dissolves (HHS). Veterinary records sit outside HIPAA, which does not apply to animals, but some states strictly regulate disclosing veterinary patient and client data without consent (JAVMA).

For licensing de-identified charts or imaging, see patient records and medical imaging.

Source: HHS: Does HIPAA require covered entities to keep medical records for any period?

Keeping business records after closing outside the US

Each country sets its own periods. The closing checklists for the UK, Canada, Australia and India each have a records section with the local rules and sources.

Record retention checklist for a closing business

Work through it before the last system is cancelled:

• List every record series and the system or cabinet that holds it.
• Give each series its clock, its period (the longest rule that applies) and a destruction date.
• Name a custodian and an address, and put them on the final Form 941 or 944 statement.
• Put a legal hold on anything tied to an open or expected claim, charge or lawsuit.
• Export every system you will cancel, and keep admin access until the export is checked.
• Check whether operational records can be licensed before they are deleted.
• Wipe or destroy drives before selling or donating computers.
• Use a destruction vendor you have vetted, under a written contract.
• Keep the schedule and destruction records with the company's closing file.

Next step

Start with one list of every record series, where it lives and how long it must be kept. Then describe the operational records at company level, such as systems, years and approximate volume, and find out what they are worth before anything is destroyed. No export is needed for that.

Origin Data Partners is independent and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records. See what your data is worth.