A clear record retention schedule helps a small business find evidence when it needs it, avoid premature deletion, and remove personal information when there is no legitimate reason to keep it. This guide provides a reusable checklist for business, tax, employee, customer, contract, insurance, and dispute-related records, while emphasizing that the correct period can depend on federal, state, local, industry, contract, and litigation requirements.
Overview
There is no single record retention period that applies to every small business. The right answer may change based on the type of record, where the business operates, the nature of its work, whether employees are involved, and whether a tax review, investigation, claim, audit, or contract dispute is reasonably anticipated.
Use the schedule below as an internal planning framework rather than a substitute for legal or accounting advice. For each category, identify the applicable rule, document the business decision, assign an owner, and record the destruction date or review date.
| Record category | Practical retention approach | Important checks |
|---|---|---|
| Formation documents and ownership records | Keep permanently or for as long as the business exists, with secure backups. | Include formation filings, amendments, ownership changes, governing documents, and dissolution records. |
| Contracts and amendments | Keep while active and after expiration for the period needed to address claims, warranties, payment issues, and legal obligations. | Check the contract's notice, warranty, indemnity, audit, and survival clauses. |
| Invoices, receipts, and payment records | Retain for the applicable tax, accounting, dispute, and payment-reconciliation period. | Preserve supporting documents for significant purchases, reimbursements, and deductions. |
| Tax returns and supporting records | Use the period required by the relevant tax authority; when uncertain, keep the return and supporting records longer rather than deleting them during an open issue. | Consider amended returns, audits, asset basis, employment taxes, and records tied to property or long-term transactions. |
| Payroll and employee records | Separate general personnel files from payroll, time, benefits, medical, and hiring records, and apply the longest applicable requirement to each set. | Federal and state employment rules may differ by record type and employee status. |
| Permits, licenses, and inspections | Keep current documents and prior versions for as long as needed to demonstrate compliance, renewals, and operating history. | Review local, professional, environmental, health, and industry-specific rules. |
| Insurance policies and claims | Keep policies, certificates, endorsements, notices, and claim files for the relevant coverage and potential claim period. | Do not discard an old policy merely because it has expired; a later claim may concern an earlier coverage period. |
| Customer and vendor records | Keep only while needed for the relationship, payment, warranty, legal, or regulatory purpose, subject to privacy obligations. | Limit access and separate necessary business records from unnecessary personal information. |
| Complaints, incidents, and dispute evidence | Retain while the issue is unresolved and until the applicable claim or legal deadline has safely passed. | Preserve emails, photographs, logs, recordings, messages, and relevant metadata when a dispute is possible. |
For related compliance planning, use the Small Business Legal Compliance Calendar. If a claim or deadline may be involved, review the Statute of Limitations Guide before deleting anything.
Checklist by scenario
Before routine annual cleanup
- Export or preserve the current retention schedule and its last review date.
- List every system that stores records, including accounting software, email, cloud drives, phones, messaging tools, and paper files.
- Group records by function rather than deleting files one folder at a time.
- Check for open invoices, unresolved complaints, insurance claims, audits, investigations, and contract obligations.
- Apply the longest relevant retention requirement where records overlap.
- Approve destruction through a named owner and keep a destruction log containing the category, date range, method, and approver.
When hiring or terminating an employee
- Keep hiring, payroll, timekeeping, benefits, performance, safety, and separation records in appropriate, access-controlled locations.
- Separate sensitive medical or accommodation information from the general personnel file.
- Confirm whether a complaint, wage issue, leave matter, discrimination allegation, or threatened claim requires a legal hold.
- Disable unnecessary access without deleting records that must be preserved.
When signing or ending a contract
- Save the signed version, exhibits, amendments, notices, invoices, delivery records, and communications that explain performance.
- Record the start date, renewal date, termination date, notice deadline, and any post-termination duties.
- Review audit, confidentiality, data-protection, warranty, indemnity, and record-access clauses.
- Do not destroy a contract file simply because the relationship has ended.
The small business contract review checklist can help identify clauses that affect retention. For confidentiality obligations, see NDA Templates Explained.
When a claim, audit, or investigation appears possible
- Pause routine deletion for potentially relevant records.
- Identify custodians, devices, accounts, and date ranges that may contain evidence.
- Preserve originals and document any conversion, export, or collection process.
- Ask qualified legal counsel whether a formal litigation hold or other preservation notice is appropriate.
What to double-check
Before setting a destruction date, check the business's operating states and local jurisdictions, the type of industry, the record's purpose, and the relationship between related documents. Employment records may have different rules from tax records. A customer database may be governed by privacy commitments even when no specific retention period is stated. A contract may require records to remain available for audit or verification after termination.
Also check whether the record is needed to establish ownership, asset basis, insurance coverage, intellectual property rights, or a recurring license. A record that appears old may still support a current legal or financial position. Review privacy and deletion obligations alongside retention duties; keeping everything forever is not a complete compliance strategy. The GDPR and Website Privacy Compliance Checklist offers a useful prompt for reviewing personal-data practices where applicable.
Common mistakes
- Using one period for every record. Different categories have different purposes and requirements.
- Keeping only the final document. Drafts, approvals, notices, and supporting evidence may explain what happened.
- Deleting email without checking other systems. Relevant messages may also exist in shared drives, phones, project tools, or accounting platforms.
- Ignoring inactive businesses or former vendors. Old relationships can still create tax, warranty, insurance, or dispute issues.
- Destroying records inconsistently. Selective deletion can create confusion and may undermine credibility during a dispute.
- Failing to document destruction. A simple log helps show that deletion followed a neutral policy rather than targeting unfavorable evidence.
- Confusing backup copies with an organized archive. Backups should be protected, recoverable when needed, and covered by a documented deletion process.
When to revisit
Review the schedule at least annually, before a seasonal cleanup, and whenever the business changes its workflows or tools. Revisit it immediately after entering a new state, launching a new product, hiring employees, changing payroll or accounting systems, collecting new types of customer information, renewing insurance, or adopting a major contract.
Do not rely on the schedule alone when a dispute, audit, investigation, complaint, or threatened claim arises. Pause deletion and obtain appropriate legal guidance. For a practical next step, create a one-page inventory with these columns: record category, system or location, business owner, applicable rule or reason to retain, review date, destruction date, and legal-hold status. Assign an owner for each category, schedule the next review, and update the inventory whenever a workflow changes.
This article is general information, not legal, tax, accounting, or privacy advice. Retention requirements vary, so confirm the rules that apply to the business before deleting records.
