Records retention and destruction

Last updated October 21, 2026

Sending boxes to an offsite vault gets them out of the office. The obligations attached to them stay with you. You still have to keep each record for its required period, show where it was and who handled it, stop destruction when litigation is on the horizon and destroy it properly when its time is up. For what offsite records storage is and how to compare providers, see records storage.

The periods and rules below are examples from US federal sources, current as of October 2026. State law, industry regulators and contracts often add longer periods, so confirm your own schedule with counsel before relying on it.

Retention schedules

A retention schedule is a table listing, for each category of record, how long it’s kept, what event starts the clock and what happens at the end. The federal government’s version is a decent model. NARA’s General Records Schedules give agencies standing disposition authority for the administrative records they all have in common, so no agency has to ask for approval item by item.

A private-sector schedule works the same way. Start from record series rather than individual documents: “accounts payable invoices” is a series, a single invoice isn’t. Find the rule that governs each series. Tax, employment, safety, health privacy and industry rules all set their own minimums, and where two apply, the longer one wins. Pin down the trigger, because many periods run from an event and not from the date a document was created, such as the end of employment, the end of a calendar year, the date a tax was paid or the last date a policy was in effect. Decide the disposition (destroy, transfer to an archive or review again) and write down who signs off on destruction. Finally, carry the schedule into storage. Every box or file offsite should have its series code and a calculated destruction date, so the provider’s system can flag it when the date comes up.

Some common US federal minimums:

Record type	Minimum retention	Citation
Income tax records (default)	3 years	IRS, How long should I keep records
Income tax records where unreported income exceeds 25% of gross income shown	6 years	IRS, same page
Tax records supporting a bad debt deduction or worthless securities loss	7 years	IRS, same page
Employment tax records	At least 4 years after the tax is due or paid, whichever is later	IRS, same page
FLSA payroll records, contracts and sales/purchase records	At least 3 years	29 CFR 516.5
Form I-9	Later of 3 years after hire or 1 year after employment ends	8 CFR 274a.2(b)(2)(i)(A)
OSHA 300 Log, 300A summary and 301 incident reports	5 years after the end of the calendar year covered	29 CFR 1904.33
Employee medical records	Duration of employment plus 30 years	29 CFR 1910.1020(d)(1)(i)
Employee exposure records	At least 30 years	29 CFR 1910.1020(d)(1)(ii)
HIPAA Security Rule policies, procedures and required documentation	6 years from creation or last effective date, whichever is later	45 CFR 164.316(b)(2)(i)
HIPAA Privacy Rule documentation	6 years from creation or last effective date, whichever is later	45 CFR 164.530(j)(2)

Two of these get misread a lot. The HIPAA six-year rule covers compliance documentation, not patient charts. HHS says the Privacy Rule does not set medical record retention periods and that state law generally governs them. And the IRS periods are for tax purposes only; the IRS itself points out that insurers or creditors may want records kept longer.

Custody, access and legal holds

A retention period does you no good if you can’t find the record or show it wasn’t altered or lost along the way. Chain of custody is the documented trail of every handoff, from pickup at your office through transport, intake, shelving, retrieval and refiling to final destruction.

That trail rests on unique identifiers. Each box, and often each folder inside it, carries a barcode that gets scanned at every event. Many providers scan the shelf location too, so the system knows exactly where a box sits and not only that it arrived. RFID tags let a reader capture many items at once, which helps when auditing a whole aisle or confirming that every file in a returned batch is back. For handling individual items, barcodes are still the norm, since they’re cheap and every scan is deliberate.

When you look at a provider, ask for a sample custody report on a single box. You want dates, times, the person or vehicle responsible for each step and the location at rest. Gaps of several days with no scan, or entries that just say “in transit,” leave holes in the record you’d need in an audit or a lawsuit.

Access control is the other half of custody. A sound setup records who requested a record, who approved the request, who handled it at the facility and when it came back. Keep the authorized-requester list yourself rather than leaving it to the provider, and update it when people leave. For health information, the HIPAA Privacy Rule requires appropriate administrative, technical and physical safeguards for as long as protected health information is kept, and that includes paper sitting in a storage vault.

A legal hold overrides the schedule. Once litigation or an investigation is reasonably anticipated, relevant records have to be preserved even if their destruction date has passed. In federal civil cases, Rule 37(e) of the Federal Rules of Civil Procedure deals with electronically stored information that “should have been preserved in the anticipation or conduct of litigation” and was lost because a party didn’t take reasonable steps. Paper boxes deserve the same discipline. On the provider side, you need to be able to flag specific boxes or whole series as held, held items need to drop off destruction lists automatically, and only named people on your side should be able to lift the flag. Test it before you need it.

Destruction

Destruction should be documented as carefully as storage. For paper and physical media, the main US certification is NAID AAA, which i-SIGMA still runs under that name, with separate applications for physical media destruction and for electronic media erasure. Certification is voluntary. Ask for the current certificate and check its scope.

For hard drives, tapes, flash media and cloud storage, the reference is NIST SP 800-88 Revision 2, Guidelines for Media Sanitization, published in September 2025 to replace the 2014 Revision 1. NIST’s FAQ on the revision explains that Rev. 2 drops the media-specific technique tables in favor of a sanitization program built on three methods: clear, purge and destroy. A few points in the FAQ cut against older habits. Multi-pass overwriting is described as unnecessary for modern storage. Degaussing is treated as a purge technique for legacy magnetic media, not a destroy method. And organizations are expected to keep evidence, such as certificates of sanitization, and to verify and validate the results.

Whatever the medium, a destruction certificate should list the box or asset IDs destroyed, the date, the method and the witness or operator. A certificate that only says “40 boxes shredded” can’t be reconciled against your schedule.

The storage facility

Paper burns, so fire protection is the first facility question. NFPA 232, the Standard for the Protection of Records, covers equipment, facilities and handling methods for protecting records from fire. Check which edition your jurisdiction or insurer uses.

The most detailed public benchmark is 36 CFR Part 1234, the federal rule for facilities that hold federal records. It binds only federal records, but private buyers often measure providers against it. Storage areas have to be separated by three-hour fire barrier walls, with no more than 250,000 cubic feet of records in any one area. The detection and suppression system must be professionally designed so a single fire destroys no more than 300 cubic feet of records, using a design scenario of 8 ounces of accelerant. Where sprinklers are required they follow NFPA 13, and detection and suppression designs must be done or reviewed by a licensed fire protection engineer. The building must sit at least five feet above and 100 feet from any 100-year floodplain, or be protected by a qualifying flood wall. The same rule says paper records should be kept in conditions that prevent active mold growth, avoiding relative humidity above 70%. The facility checklist has a longer list of questions for site visits.

Film, tape and electronic media have different needs, and colder isn’t always better. NARA’s internal storage standard, NARA 1571, Supplement 2, sets 50 to 65°F at 30 to 50% relative humidity for paper, polyester-based black-and-white film and maps. Magnetic tape, disks, optical media, hard drives, and video and audio tape get the same 50 to 65°F band, and NARA notes that cold storage doesn’t extend their life and can damage them. Cellulose acetate film, which includes many older microfilms, and color film go into cold storage at 35°F and 30 to 40% RH, never below 32°F, with an acclimation room where items rest 4 to 24 hours before use so condensation doesn’t form.

NARA also warns that acidic paper, magnetic media and many films last only decades if stored at or above 70°F. Stable conditions count as much as the set point, so ask providers for logged temperature and humidity data, not the thermostat setting. For how warehouses define temperature bands in general, see cold storage temperature zones.

Personal data outside the US

If the boxes hold personal data about people in the EU, the GDPR’s storage limitation principle applies. Article 5(1)(e) says personal data must be kept in identifiable form no longer than necessary for the purposes it was processed for, with limited exceptions for archiving in the public interest, research and statistics. That turns retention into a maximum as well as a minimum. The schedule needs an end date, and destruction has to happen on time. Other national privacy laws take similar approaches, so look into them before you choose a provider abroad.

Common questions

How long does the IRS say to keep business tax records?

The IRS default is 3 years from filing. It rises to 6 years if income was underreported by more than 25%, and to 7 years for bad debt or worthless securities claims. Keep employment tax records at least 4 years after the tax is due or paid, whichever is later.

Does HIPAA set a retention period for medical records?

No. HIPAA requires covered entities to keep their compliance documentation, such as policies and procedures, for 6 years. How long patient medical records are kept is generally a matter of state law.

How long must employers keep employee exposure and medical records under OSHA?

Under 29 CFR 1910.1020, exposure records must be kept at least 30 years, and medical records for the duration of employment plus 30 years, unless a specific OSHA standard says otherwise.

What does a legal hold do to a retention schedule?

It suspends scheduled destruction for every record the hold covers until counsel releases it. The storage provider needs a way to flag held boxes and files so they stay out of destruction runs.

Is NAID AAA still the name of the shredding certification?

Yes. i-SIGMA runs it and still calls it NAID AAA Certification, with separate applications for physical media destruction and electronic media erasure.

What is the current NIST standard for media sanitization?

NIST SP 800-88 Revision 2, Guidelines for Media Sanitization, published in September 2025. It replaced Revision 1 from 2014 and organizes sanitization into clear, purge and destroy methods.

Sources

If something here is wrong or out of date, please let us know.