Payroll Record Retention Requirements Under Federal and State Law

Payroll record retention in the United States is not one rule, but a layered system. Federal law sets minimum retention periods that vary by agency and by the type of record, and state law often sits on top, so it can extend them further. The employer's actual obligation, for any given record, is whichever period runs longest once every applicable layer is accounted for. A single payroll record can fall under a federal wage-and-hour law, a federal tax code, an employment-discrimination agency's regulations, and a federal benefits law all at once, and if a state statute adds its own window on top of any of those, the employer owes the longest of all of them. There is no menu of choices here: the retention clock that governs is the one that runs furthest into the future, and every subsequent layer discussed in this piece adds to the ones before it.

What the FLSA requires employers to keep and for how long

The Fair Labor Standards Act is the foundational federal requirement, and it sets up two distinct retention clocks, but employers routinely conflate them, which is the most common compliance mistake at the federal level. The first clock covers basic payroll records, the documents that identify the employee and show what was paid, and these must be kept for at least three years. A Department of Labor fact sheet spells out the data elements that belong in this category: the employee's full name and Social Security number; their address, including zip code; birth date, if the employee is younger than 19; sex and occupation; the time and day of the week their workweek begins; hours worked each day and each workweek; the basis on which wages are paid; the regular hourly pay rate; total daily or weekly straight-time earnings; total overtime earnings for the workweek; all additions to or deductions from wages; total wages paid each pay period; and the date of payment along with the pay period it covers. The second clock covers supplementary wage-computation records, the documents that explain how pay was calculated rather than simply what was paid, and these carry a shorter minimum of two years. The same Department of Labor fact sheet identifies this second category as time cards, piece-work tickets, wage rate tables, work and time schedules, and records of additions to or deductions from wages. Payroll software provider Points North confirms that the two-year period applies specifically to the supplementary records underlying wage computations, reinforcing that this is a separate and shorter clock from the three-year period governing basic payroll data. Notably, the FLSA imposes no required format for any of these records. It asks only that the required information be present and accurate, and Fact Sheet #21 specifies that records may be kept either at the place of employment or in a central records office, leaving the storage method itself largely up to the employer.

What the IRS, EEOC, and ERISA each add on top of the FLSA baseline

Three other major federal agencies add their own retention requirements on top of the FLSA baseline, and their records overlap substantially with payroll data, but each one runs on a different clock. The IRS requires you to keep employment tax records for four years after the tax is due or paid, whichever date comes later, and both Points North and payroll provider Lightspeed confirm this. Lightspeed's enumeration of what belongs in this category is extensive: the employer identification number; employer tax forms and payment receipts; IRS notifications, including remittance frequency status; the amounts and dates of all taxable wage, annuity, and pension payments; employee addresses, Social Security numbers, occupations, dates of employment, and tax documents such as W-4s and W-2s; records relating to sick leave and overtime wages; and the amounts of tips reported. Because the IRS's four-year period already exceeds the FLSA's three-year period for basic payroll records, many employers find it operationally simplest to apply the IRS clock as the default for all payroll data, a practice that automatically satisfies the FLSA's shorter requirement in the process. The EEOC adds a separate layer: its general rule requires records to be kept for one year from the date the record was made or the personnel action was taken, but the Age Discrimination in Employment Act extends that to three years specifically for payroll records showing each employee's name, address, date of birth, occupation, pay rate, and weekly compensation. Points North also notes that the Equal Pay Act imposes its own two-year requirement for records that explain pay differences between employees, a narrower category aimed at justifying compensation gaps. ERISA imposes the longest federal window among these three agencies: retirement and benefit plan records must be kept for at least six years after the filing date of the plan document they support, such as Form 5500. For employers who sponsor retirement plans, this six-year ERISA period functions as the practical ceiling at the federal level, exceeding the IRS's four years, the FLSA's three years, and the EEOC's one-to-three-year window. Even without any state law in the picture, a single payroll record can therefore face three or four different federal retention clocks at once, so an employer must apply the longest of them.

What happens when records are missing, the litigation and audit exposure employers face

The most serious consequence of inadequate payroll records rarely arrives as a direct fine. It arrives as a litigation posture in which the employer has lost the ability to defend itself, because courts and agencies may presume that missing records would have supported the employee's claim rather than the employer's position. This is the mechanism behind what is often called adverse inference: when an employer cannot produce records it was legally required to keep, the fact-finder may infer that the absent records would have been unfavorable to the employer's case. A retention guide from FirstHR illustrates the mechanism with a concrete scenario. An employer discarded payroll records for all but the final year of a former employee's tenure, operating on the assumption that older records were no longer needed once the employment relationship ended. A state labor board investigation subsequently requested three years of records, the employer could not produce them, and the investigation proceeded on the assumption that the missing records would have supported the wage claim, an outcome the source describes as ultimately costing more than the underlying claim itself would have cost to resolve directly. Audit exposure compounds this risk beyond the single-claim scenario. Compliance platform ResNav notes that when the Department of Labor or a state labor agency identifies potential systemic issues, including misclassification, overtime eligibility questions, minimum wage compliance, or timekeeping accuracy, the resulting investigation tends to expand well past its original scope, and employers are routinely asked to produce years of historical data even when the inquiry that triggered the investigation covered a much shorter period. ResNav also identifies a specific operational trigger for this exposure: payroll or HR system migrations rank among the most common sources of compliance failure, because historical data can be left behind in legacy systems, archived only as static reports, or migrated incompletely, leaving the calculation-level detail that auditors actually request effectively inaccessible. These risks do not expire neatly at the end of a federal retention period, either. State statutes of limitation for wage claims can run well beyond federal retention windows, so you may still need records that are nominally eligible for disposal if state law still lets a worker bring a claim.

Where and how states extend federal minimums

Meeting federal minimums alone is not enough for most employers, because state wage-and-hour laws often extend those minimums by one to four years, and the variation across states is wide enough that a policy built strictly to the federal floor will fail in several of the country's most populous jurisdictions. Hawaii sets one of the longest windows identified among state-level rules: six years, under HRS §387-6 and the Wage Standards Division rule issued under that statute, as ResNav notes in its state-by-state index. The same ResNav index lists Illinois as requiring three years of retention for both payroll records and time records. California presents a more layered picture within a single state: time records must be kept for four years because of wage claim risks arising under the state's Unfair Competition Law, pay stubs carry a separate three-year minimum, and for employers offering health insurance plans, ERISA's six-year rule for benefit plan records applies on top of both. ResNav observes that across states generally, many jurisdictions require payroll and HR records to be kept for four to six years, and some allow extended lookback periods once an enforcement action begins, so the statutory retention period works as a floor, not a ceiling, the moment an investigation opens. For employers operating in multiple states, the only defensible approach is to build a retention policy around the single most stringent state rule that applies to any of the business's employees, rather than an average or a median across locations. If one employee works in a high-retention state, that employee's records set the retention floor, no matter what a shorter-retention state might otherwise permit. This pattern is a general tendency, so you should treat the jurisdictions discussed here as illustrative of the range of state law.

Special retention rules for certified payroll on prevailing wage projects

Employers on federal or state prevailing wage projects face a separate retention obligation, and it sits alongside their standard FLSA and IRS requirements, not in place of them. Points North treats certified payroll and prevailing wage record retention as its own category, and it notes that contractors on prevailing wage projects carry project-based retention requirements for certified payroll records. So a contractor cannot just retire certified payroll records on the same schedule used for general payroll data. The retention clock for these records runs from the project's completion date, not from each individual pay period, and federal contract compliance audits can ask for certified payroll documentation long after a project has closed out. Employers who assume their standard payroll retention policy automatically covers prevailing wage work are exposed to a compliance gap that the general FLSA and IRS rules were never designed to close.

How to store payroll records

Federal agencies accept electronic storage of payroll records, but they ask for more than just saving a file somewhere. A system that keeps records but cannot produce accessible, intact data on demand fails to satisfy federal inspection requirements regardless of the format used. The Department of Labor's FLSA fact sheet specifies that records must remain open for inspection by Wage and Hour Division representatives, who are entitled to ask the employer to make extensions, computations, or transcriptions from the stored data. A system that retains records but cannot produce the required detail on demand, in a form an investigator can actually use, does not satisfy this requirement regardless of how long the underlying data has technically been preserved. This matters directly for the migration risk described earlier: a payroll archive that survives a system transition only as a static report, stripped of the calculation-level detail an auditor would need to verify overtime pay or wage deductions, fails the accessibility standard even though the records nominally still exist. When you evaluate an electronic payroll system, you need to weigh not only whether it stores data for the correct number of years under each applicable federal and state clock, but whether it can retrieve and reproduce that data, with the full detail agencies require, the moment an inspection or investigation calls for it.