Payroll Records: What to Keep and How Long to Keep It

A former employee filed a wage claim against a company I advised, alleging he had worked unpaid hours before his shift for about a year. He had no evidence beyond his own account. The company was certain he was wrong.

It did not matter. Their time records were fragments: a spreadsheet that had been rebuilt twice, some months missing entirely, nothing that showed when he actually clocked in. Because they could not produce records, the legal standard he had to meet dropped to what a court calls a just and reasonable inference. His recollection became the evidence. Their inability to rebut it became the finding.

That is the thing nobody tells you about payroll records. The penalty for bad recordkeeping is rarely a fine for bad recordkeeping. It is that you lose an argument you would have won.

This guide is how you keep that from happening to you. It covers what payroll records are, what the law requires you to capture, exactly how long to keep each type, what your state adds on top, how to store and eventually destroy them, and how to run all of it at a small business with nobody doing HR full time.

What Is a Payroll Record?

A payroll record is any document an employer uses to pay, tax, or account for an employee. It is a category, not a single file, and the category is broader than most owners assume.

The last sentence is the one to internalize: the duty is the employer's. It does not transfer to the employee or to your payroll vendor. An employee who kept no notes has failed at nothing. An employer who kept no records has failed at a legal obligation, and the law responds to that asymmetry in a way we will get to shortly.

What Counts as a Payroll Record

Six families of documents make up the payroll record set at a typical small business. Different families fall under different retention clocks, which is why treating payroll records as one undifferentiated pile eventually causes a problem.

Two things look like payroll records but are not, and misfiling them causes real trouble. Form I-9 is not a payroll record and should be stored separately. Neither are medical records, which belong in their own confidential file. Both get filed with payroll constantly, and both create access-control problems when they are. More on that below.

What the FLSA Requires You to Record

For every non-exempt employee, the Fair Labor Standards Act specifies exactly what information the records must contain. Per Department of Labor (DOL) Fact Sheet #21, no particular form is required, but the content is not optional.

Notice that most of these are things your payroll system already produces. The failure mode at small companies is almost never that the data never existed. It is that the data existed in a system nobody exported from, and then the system changed.

Why Missing Records Are So Expensive

Missing records are expensive because of what they do to your case, not because of a fine. The FLSA sets no general civil fine for poor payroll records, and its criminal fine of up to $10,000 reaches only willful violations. What costs you is the burden of proof: inadequate records shift it against you.

The rule comes from a 1946 Supreme Court decision, Anderson v. Mt. Clemens Pottery Co., and it has governed wage litigation ever since.

Read that mechanism carefully, because it inverts the intuition most owners have. Business owners tend to think of missing records as a gap in their own evidence, a nuisance. It is worse than that. Missing records are affirmative help to the person suing you. They lower the standard the claimant has to meet and simultaneously destroy your ability to answer.

And it scales. This is precisely the doctrine that converts a single employee's small claim into a collective action covering everyone in the role, because if the employer's records cannot disprove one person's inference, they cannot disprove anyone's.

The FLSA back-pay window runs two years, three for willful violations, and liquidated damages, an added payment on top of the back wages, can double the award.

How Long to Keep Payroll Records

The short answer for most small businesses is four years, but there is no single number, because different agencies impose different clocks on the same paycheck. Three clocks matter most: the FLSA's two and the IRS's one.

The FLSA sets two clocks. Payroll records must be preserved for at least three years. But the records on which wage computations are based, meaning time cards, piece work tickets, wage rate tables, and work and time schedules, are required for only two.

Nearly every vendor guide flattens the FLSA split into a single three-year rule. The split is real, though, and comes verbatim from the Department of Labor.

The IRS imposes four years. Per IRS employment tax recordkeeping guidance, all records of employment taxes must be kept at least four years after you file the fourth quarter for that year. That covers W-4s, employment tax returns, deposit records, and the wage data behind them.

Other statutes add their own. Per the recordkeeping requirements of the Equal Employment Opportunity Commission (EEOC), personnel records run one year, extended if a charge is filed. The Equal Pay Act asks for two years on records explaining wage differentials, and the age discrimination rules at 29 CFR 1627.3 put payroll records on a three-year clock.

The Employee Retirement Income Security Act (ERISA) belongs to that same group and runs the longest clock in it. Benefit plan records must be kept six years, measured from the filing date of the documents the information supports, so a plan year that closed quietly years ago is still live in the filing cabinet.

The Master Retention Table

Here are the main record types mapped to their minimum retention periods and the authorities that set them. Treat the minimums as floors, not targets.

The last row is the one to act on. Everything above it is why that row is correct.

When Your State Demands More

Federal minimums are the floor. Payroll record retention varies by state, and where a state rule and a federal rule cover the same document you follow the longer one. The table below takes six states that either run the clock past the federal minimum or attach an employee access right to it, plus the rule that governs employers operating across state lines.

Each of those clocks sits in a statute or regulation you can read yourself. New York runs on Labor Law 195, which sets both the six-year period and the weekly content each record must show.

New Jersey runs on N.J.A.C. 12:56-4.4 and 4.5, which set the six-year period and require the records to stay at the place of employment or in a central office in New Jersey.

The remaining clocks are just as easy to look up. The nine wage statement elements in California and the 21-calendar-day access deadline both sit in Labor Code 226, along with the $750 penalty for missing it. Texas runs on Texas Workforce Commission rule 815.106, and Massachusetts on M.G.L. c.151 Section 15, which is where that immediate-production duty comes from.

The remote-employee row is how a compliant company quietly becomes non-compliant. Hiring one person in a state with longer retention or an access right does not create a small exception. It creates an obligation you now have to meet, on that person's records, from a system designed around your home state's rules.

State requirements also change, so treat any figure here as a prompt to verify rather than a fact to memorize.

What Must Be Kept Separate

Not everything about an employee belongs in the same folder, and the two separations that matter most rest on different footing. Medical information must sit in a separate confidential file under the Americans with Disabilities Act (ADA) regulations at 29 CFR 1630.14.

Keeping Form I-9 apart from personnel records is a recommendation from U.S. Citizenship and Immigration Services (USCIS) rather than a statutory command, which is not a reason to skip it.

The I-9 separation is the one small businesses skip most often, and it is nearly free to get right.

Paper, Digital, and the 72-Hour Rule

The FLSA prescribes no particular form for records. Paper is legal. Digital is legal. What matters is that the records are accurate, complete, and can be produced legibly when someone asks.

One number governs the practical requirement. Under 29 CFR 516.7, records kept at a central recordkeeping office rather than at the worksite must be made available within 72 hours following notice from the Wage and Hour Administrator. Three days. Not three weeks while someone digs through a storage unit or emails a former bookkeeper.

That deadline is what makes paper impractical past a certain size, and it is what makes vendor dependence risky. A payroll portal you no longer have a subscription to is not a records system. Neither is a spreadsheet on the laptop of someone who left.

Ask yourself concretely: if the DOL called on a Monday, could you produce four years of payroll registers and timesheets by Thursday?

The only honest way to answer that question is to go and look. Fill one row per record family with where the file actually lives today, who holds the key to it, and whether you could hand it over inside three days. The rows that come back blank or uncertain are the ones to fix this month.

Can Employees See Their Own Payroll Records?

There is no general federal right for an employee to inspect their payroll file, but many states create one, and the deadlines are short enough to catch an unprepared employer.

California gives current and former employees the right to inspect or copy their payroll records, and the employer must comply within 21 calendar days of the request or face a $750 penalty. The clock runs from the request date, not from the day somebody gets to it.

Washington splits the question, and the split is easy to get backwards. Copies of payroll records go out at any reasonable time, while a complete copy of the personnel file is due within 21 calendar days. Other states set their own rules, deadlines, and penalties.

The practical advice is unglamorous: know your state's rule before you get the request, and name the person who will respond to it. A records request from a former employee is very often the opening move in a wage claim, and missing the deadline gives the other side a second violation to point at before the first one has even been examined.

How to Destroy Records Properly

Once a record's retention period ends, destroy it securely rather than tossing it. Payroll records contain Social Security numbers, bank account details, and full wage histories. Putting that in a dumpster is a data protection failure regardless of what the retention schedule said.

Paper should be shredded, burned, or pulverized so the information cannot be practically read or reconstructed. Electronic records should be securely wiped rather than merely deleted, since a deleted file is frequently recoverable. And the destruction should follow a documented policy, executed on schedule, with a log of what was destroyed and when.

The Federal Trade Commission (FTC) Disposal Rule is where those methods come from. Its examples of reasonable disposal are to burn, pulverize, or shred papers holding consumer report information, and to destroy or erase electronic files so the information cannot be read or reconstructed. Its scope is background check data rather than payroll registers, but payroll deserves the same treatment.

The written policy matters more than it sounds. There is an enormous legal difference between a record that was destroyed on schedule under that policy and a record that simply cannot be found. One is compliance. The other can look, to an investigator or a plaintiff's attorney, like concealment.

Litigation changes the schedule: once you know a dispute is probable, routine destruction has to stop, because destroying records after a dispute is anticipated is a separate and much worse problem.

Two sheets are enough to make destruction a policy instead of a gap. The first lists what is coming up for destruction and forces a hold check before anything goes. The second records what actually went, when, how, and on whose authority.

Running This Without an HR Department

None of this is hard. It is just unowned. At most small businesses, the payroll registers live in a vendor portal, the timesheets live in a different app, the W-4s are PDFs in someone's email, and the retention policy is that nobody has ever deleted anything on purpose.

That arrangement survives right up until someone asks you to produce four years of records in 72 hours.

This is the layer FirstHR is built for. Document management keeps payroll documents, tax forms, and authorizations in one retrievable place rather than scattered across a vendor portal and three inboxes. Employee profiles hold the records tied to the person they belong to. E-signature captures the deduction authorizations and acknowledgments that have to be traceable. Completed I-9s can be filed under the Compliance document category, and only the Main Admin and HR can open Employee Records.

Your payroll provider keeps running the pay cycle and filing your taxes. FirstHR holds the record layer around that work, which is the part that goes missing when a provider changes or a bookkeeper leaves.

If you do one thing after reading this: export the last four years of payroll registers and time records from wherever they currently live, and put them somewhere you will still control in five years. That single afternoon is worth more than every other recordkeeping improvement combined.

Frequently Asked Questions