Payroll Records: What to Keep and How Long to Keep It
What payroll records are and what the law requires. The FLSA 3-year and 2-year split, the IRS 4-year rule, and what missing records really cost you.
Payroll Records
What counts, what the law demands, and why the missing file is the expensive one
A former employee filed a wage claim against a company I advised, alleging he had worked unpaid hours before his shift for about a year. He had no evidence beyond his own account. The company was certain he was wrong.
It did not matter. Their time records were fragments: a spreadsheet that had been rebuilt twice, some months missing entirely, nothing that showed when he actually clocked in. Because they could not produce records, the legal standard he had to meet dropped to what a court calls a just and reasonable inference. His recollection became the evidence. Their inability to rebut it became the finding.
That is the thing nobody tells you about payroll records. The penalty for bad recordkeeping is rarely a fine for bad recordkeeping. It is that you lose an argument you would have won. This guide covers what payroll records are, what the law requires you to capture, exactly how long to keep each type, what your state adds on top, how to store and eventually destroy them, and how to run all of it at a company with 5 to 50 employees and nobody doing HR full time.
What Is a Payroll Record?
A payroll record is any document an employer uses to pay, tax, or account for an employee. It is a category, not a single file, and the category is broader than most owners assume.
The last sentence is the one to internalize. The duty is the employer's. It does not transfer to the employee, and it does not transfer to your payroll vendor. An employee who kept no notes has failed at nothing. An employer who kept no records has failed at a statutory obligation, and the law responds to that asymmetry in a way we will get to shortly.
What Counts as a Payroll Record
Six families of documents make up the payroll record set at a typical small business. Each carries its own retention clock, which is why treating payroll records as one undifferentiated pile eventually causes a problem.
Worth flagging what is not a payroll record, because misfiling here causes real trouble. Form I-9 is not a payroll record and should be stored separately. Neither are medical records, which belong in their own confidential file. Both get filed with payroll constantly, and both create access-control problems when they are. More on that below.
What the FLSA Requires You to Record
For every non-exempt employee, the Fair Labor Standards Act specifies exactly what information the records must contain. Per DOL Fact Sheet #21, no particular form is required, but the content is not optional.
| # | Required Information | Where People Get It Wrong |
|---|---|---|
| 1-4 | Full name and Social Security number, address including ZIP code, birth date if under 19, sex and occupation. | The birth date requirement for minors is routinely skipped, and it is the first thing an investigator checks when a teenager is on payroll. |
| 5 | The time and day of the week when the employee's workweek begins. | Most small businesses have never written this down. It is a required record and it determines how overtime is counted. |
| 6-7 | Hours worked each day, and total hours worked each workweek. | Daily hours, not just the weekly total. A weekly sum with no daily detail is an incomplete record. |
| 8-9 | The basis on which wages are paid, and the regular hourly pay rate. | The basis means the arrangement itself: $18 per hour, $900 a week, piecework. Not just the number. |
| 10-11 | Total daily or weekly straight-time earnings, and total overtime earnings for the workweek. | Overtime earnings must be recorded separately, not folded into a single gross figure. |
| 12-14 | All additions to and deductions from wages, total wages paid each pay period, and the date of payment with the period it covers. | Deductions need to be itemized and traceable to an authorization, which means the authorization is itself a record you keep. |
Notice that most of these are things your payroll system already produces. The failure mode at small companies is almost never that the data never existed. It is that the data existed in a system nobody exported from, and then the system changed.
Why Missing Records Are So Expensive
Here is the part that almost no other guide on this topic covers, and it is by far the most important thing on this page. There is generally no standalone federal fine for failing to keep payroll records. The cost arrives a different way: inadequate records shift the burden of proof against you.
The rule comes from a 1946 Supreme Court decision, Anderson v. Mt. Clemens Pottery Co., and it has governed wage litigation ever since.
Read that mechanism carefully, because it inverts the intuition most owners have. Business owners tend to think of missing records as a gap in their evidence, a nuisance. It is worse than that. Missing records are affirmative help to the person suing you. They lower the standard the claimant has to meet and simultaneously destroy your ability to answer.
And it scales. This is precisely the doctrine that converts a single employee's small claim into a collective action covering everyone in the role, because if the employer's records cannot disprove one person's inference, they cannot disprove anyone's. The FLSA back-pay window runs two years, three for willful violations, and liquidated damages can double the award. The overtime guide covers the underlying wage obligations these claims are built on.
How Long to Keep Payroll Records
The honest answer is that there is no single number, because different agencies impose different clocks on the same paycheck. Three of them matter for a small business.
The FLSA imposes a split that most articles get wrong. Payroll records must be preserved for at least three years. But the records on which wage computations are based, meaning time cards, piece work tickets, wage rate tables, and work and time schedules, are required for only two. Nearly every vendor guide flattens this into a single three-year rule. The split is real and comes verbatim from the Department of Labor.
The IRS imposes four years. Per IRS employment tax recordkeeping guidance, all employment tax records must be kept at least four years after the date the tax becomes due or is paid, whichever is later. That covers W-4s, employment tax returns, deposit records, and the wage data behind them.
Other statutes add their own. Per the EEOC recordkeeping requirements, personnel records run one year, extended if a charge is filed. The Equal Pay Act asks for two years on records explaining wage differentials. ERISA wants six years on benefit plan records.
The Master Retention Table
Here is every record type mapped to its minimum retention period and the authority that sets it. Treat the minimums as floors, not targets.
| Record Type | Minimum Retention | Governing Authority |
|---|---|---|
| Payroll register, earnings records, collective bargaining agreements | 3 years | FLSA, 29 CFR 516.5 |
| Time cards, timesheets, work and time schedules, wage rate tables, piece work tickets | 2 years | FLSA, 29 CFR 516.6 (records wage computations are based on) |
| Employment tax records: W-4, W-2/W-3, Forms 941 or 944, Form 940, deposit records | 4 years after the tax is due or paid, whichever is later | IRS employment tax recordkeeping |
| Records explaining wage differentials between sexes | 2 years | Equal Pay Act |
| Payroll records under age discrimination rules | 3 years | ADEA |
| Personnel and employment records | 1 year, or 1 year from involuntary termination; until final disposition if a charge is filed | EEOC (Title VII, ADA) |
| Payroll and leave records tied to protected leave | 3 years | FMLA |
| Benefit plan records | 6 years | ERISA |
| Form I-9 (stored separately from payroll) | 3 years after hire, or 1 year after termination, whichever is later | USCIS |
| Practical operating rule for a small business | 4 years for everything; 7 to be conservative | Longest applicable clock governs |
The last row is the one to act on. Everything above it is why that row is correct.
When Your State Demands More
Federal minimums are the floor. Several states go well beyond them, and where state and federal rules overlap you follow the longer one.
| State | What It Adds | Why It Matters |
|---|---|---|
| New York | Payroll records must be established, maintained, and preserved for not less than six years, with detailed weekly content including hours, pay rates and basis, gross wages, deductions, and net wages. | Double the federal FLSA period. A New York employer purging at three years is out of compliance. |
| California | Itemized wage statements with nine specified elements, kept three years. Current and former employees may inspect or copy payroll records, and the employer must comply within 21 calendar days. | Failure to permit inspection carries a penalty, and wage statement violations carry per-pay-period penalties that accumulate quickly. |
| Washington | Payroll records three years, plus a statewide employee right to inspect the personnel file and request copies of payroll records within 21 days. | The access deadline is the operational trap, not the retention period. |
| Multi-state employers | There is no averaging. You retain to the longest applicable requirement across every state where you employ someone. | One remote employee in New York imposes a six-year clock on that person's records, whatever your home state says. |
The remote-employee point deserves emphasis, because it is how a compliant company quietly becomes non-compliant. Hiring one person in a state with longer retention or an access right does not create a small exception. It creates an obligation you now have to actually meet, on that person's records, from a system that was designed around your home state's rules. State requirements also change, so treat any figure here as a prompt to verify rather than a fact to memorize.
What Must Be Kept Separate
Not everything about an employee belongs in the same folder, and the separation is a legal and practical requirement rather than a filing preference.
The I-9 separation is the one small businesses skip most often, and it is nearly free to get right. The personnel file guide covers what belongs in each file, and the employee file organization guide covers the structure.
Paper, Digital, and the 72-Hour Rule
The FLSA prescribes no particular form for records. Paper is legal. Digital is legal. What matters is that the records are accurate, complete, and can be produced legibly when someone asks.
One number governs the practical requirement: records kept at a central recordkeeping office rather than at the worksite must be made available to the Department of Labor within 72 hours of notice. Three days. Not three weeks while someone digs through a storage unit or emails a former bookkeeper.
That deadline is what makes paper impractical past a certain size, and it is what makes vendor dependence risky. A payroll portal you no longer have a subscription to is not a records system. Neither is a spreadsheet on the laptop of someone who left. Ask yourself concretely: if the DOL called on a Monday, could you produce four years of payroll registers and timesheets by Thursday?
Can Employees See Their Own Payroll Records?
There is no general federal right for an employee to inspect their payroll file, but many states create one, and the deadlines are short enough to catch an unprepared employer.
California gives current and former employees the right to inspect or copy their payroll records, and the employer must comply within 21 calendar days of the request, with a statutory penalty for failing to do so. Washington similarly requires the employer to furnish copies within 21 days. Other states have their own rules, deadlines, and penalties.
The practical advice is unglamorous: know your state's rule before you get the request, and name the person who will respond to it. A records request from a former employee is very often the opening move in a wage claim, and missing the deadline gives the other side a second violation to point at before the first one has even been examined.
How to Destroy Records Properly
When records age out, they need to be destroyed, and destroyed properly. Payroll records contain Social Security numbers, bank account details, and full wage histories. Putting that in a dumpster is a data protection failure regardless of what the retention schedule said.
Paper should be shredded, burned, or pulverized so the information cannot be practically read or reconstructed. Electronic records should be securely wiped rather than merely deleted, since a deleted file is frequently recoverable. And the destruction should be a documented policy, executed on schedule, with a log of what was destroyed and when.
That last point matters more than it sounds. There is an enormous legal difference between a record that was destroyed on schedule under a written policy and a record that simply cannot be found. One is compliance. The other looks, to an investigator or a plaintiff's attorney, like something else. And if you know litigation is probable, routine destruction has to stop, because destroying records once a dispute is anticipated is a separate and much worse problem.
Running This Without an HR Department
None of this is hard. It is just unowned. At most companies with 5 to 50 employees, the payroll registers live in a vendor portal, the timesheets live in a different app, the W-4s are PDFs in someone's email, and the retention policy is that nobody has ever deleted anything on purpose.
That arrangement survives right up until someone asks you to produce four years of records in 72 hours.
| What Needs a Home | Why | What Happens Without It |
|---|---|---|
| A named owner for payroll recordkeeping | Someone has to be responsible for the export happening and the file landing somewhere permanent. | Records exist only inside systems you may not always have access to, and nobody notices until you do not. |
| A single retention policy, written down | One clock, applied to everything, set to the longest applicable period. Four years minimum. | Different record types get purged on different intuitions, and the one you needed was on the shortest one. |
| Retrievability within 72 hours | The DOL deadline for records kept at a central office is three days, not three weeks. | You technically have the records and still fail to produce them, which under Mt. Clemens is functionally the same as not having them. |
| Separate storage for I-9s and medical records | Access control and audit cleanliness. These do not belong in the payroll file. | An investigator reviewing pay data sees documents they had no need to see, and an I-9 audit becomes a search through everything. |
| A documented destruction schedule | The difference between a record destroyed on policy and a record that is mysteriously missing. | Gaps in the record look deliberate, which is the worst possible interpretation of an honest one. |
This is the layer FirstHR is built for. Document management keeps payroll documents, tax forms, and authorizations in one retrievable place rather than scattered across a vendor portal and three inboxes. Employee profiles hold the records tied to the person they belong to. E-signature captures the deduction authorizations and acknowledgments that have to be traceable. And separate document handling keeps I-9s and medical records where they belong, apart from payroll.
FirstHR is not a payroll engine and does not run your pay cycle or file your taxes; that stays with your payroll provider. What it holds is the record layer around it, which is the part that goes missing when a provider changes or a bookkeeper leaves. The HR document management guide covers the wider system this fits into.
If you do one thing after reading this: export the last four years of payroll registers and time records from wherever they currently live, and put them somewhere you will still control in five years. That single afternoon is worth more than every other recordkeeping improvement combined. The HR audit guide covers how to check the rest.
Frequently Asked Questions
What is a payroll record?
A payroll record is any document an employer uses to pay, tax, or account for an employee. The category covers the payroll register, employee earnings records, timesheets and time cards, tax forms such as W-4s and W-2s, employment tax returns, direct deposit authorizations, garnishment orders, benefit deduction records, and itemized pay statements. Payroll records are not a single document. They are the full evidentiary trail showing what an employee was paid, why, and when.
How long do you need to keep payroll records?
There is no single number, because different agencies impose different clocks. Under the FLSA, payroll records must be preserved at least three years, while the records that wage computations are based on, such as time cards and wage rate tables, must be kept two years. The IRS requires employment tax records to be kept at least four years after the tax becomes due or is paid, whichever is later. When these overlap you follow the longest applicable one, which is why four years is the practical floor for most small businesses.
What is the difference between the FLSA 3-year and 2-year rules?
The three-year rule applies to payroll records themselves, along with collective bargaining agreements and sales and purchase records. The two-year rule applies to the supporting records that wage computations are based on: time cards, piece work tickets, wage rate tables, and work and time schedules. Most online guides blur this into a single three-year rule. The distinction is real and comes straight from the Department of Labor. In practice, keeping everything for the longer period is simpler and safer than tracking two clocks.
What are the penalties for not keeping payroll records?
There is generally no standalone federal fine for the recordkeeping failure itself. The real cost is that inadequate records shift the burden of proof against you. Under Anderson v. Mt. Clemens Pottery Co., where an employer's records are inaccurate or inadequate, an employee need only show the amount of uncompensated work as a matter of just and reasonable inference. The burden then shifts to the employer to disprove it. Without records you cannot. Small individual claims become large collective actions on exactly this mechanism.
What information does the FLSA require in payroll records?
For each non-exempt employee: full name and Social Security number; address including ZIP code; birth date if younger than 19; sex and occupation; the time and day of the week when the workweek begins; hours worked each day and total hours each workweek; the basis on which wages are paid; regular hourly pay rate; total daily or weekly straight-time earnings; total overtime earnings for the workweek; all additions to and deductions from wages; total wages paid each pay period; and the date of payment with the pay period it covers.
Can payroll records be kept digitally?
Yes. The FLSA prescribes no particular form for records, so digital storage is permitted as long as the records are accurate, complete, and can be reproduced in a legible form on request. The practical constraint is retrieval: records kept at a central recordkeeping office must be made available to the Department of Labor within 72 hours of notice. The IRS similarly requires that electronic systems be able to index, store, retrieve, and reproduce records in legible format for review.
Can employees see their own payroll records?
It depends on the state. There is no general federal right for an employee to inspect their payroll file, but many states create one. California gives current and former employees the right to inspect or copy payroll records, and the employer must comply within 21 calendar days of the request, with a penalty for failing to do so. Washington requires the employer to furnish copies within 21 days. Other states have their own access rules and deadlines. Check your state before you refuse a request, because refusing one you were required to honor is its own violation.
Should I keep I-9 forms with my payroll records?
No. Form I-9 should be stored separately from payroll and personnel files. The reason is access control: an I-9 contains identity and work authorization documents you do not want casually visible to anyone reviewing pay data, and separating it makes an audit cleaner. The same logic applies to medical records, which must be kept in a separate confidential file. I-9s are retained for three years after the date of hire, or one year after employment ends, whichever is later.
Who is responsible for payroll records if I use a payroll provider?
You are. Outsourcing payroll processing does not outsource the legal duty to keep records. The obligation under the FLSA falls on the employer, and the Department of Labor will ask you, not your vendor, to produce records during an investigation. This matters most when you change providers or a provider shuts down, because access to historical reports can disappear. Download and retain your own copies of payroll registers and tax filings rather than relying on a vendor portal to exist indefinitely.
How should payroll records be destroyed after the retention period?
Securely, and not by simply throwing them out. Payroll records contain Social Security numbers, bank account details, and wage data, which makes casual disposal a data protection failure. Paper records should be shredded, burned, or pulverized so the information cannot be reconstructed. Electronic records should be securely wiped rather than merely deleted, since deleted files often remain recoverable. Document what you destroyed and when, so you can show the destruction was a policy rather than a convenient gap.