How Long Must California Businesses Keep Records? A Retention Guide

Nobody keeps paper because they want to. They keep it because they are not sure what they are allowed to throw away, and the cost of guessing wrong is worse than the cost of another storage unit.

This guide lays out the main California retention periods, what statute each comes from, and how to think about the ones that overlap. It is written for business owners and office managers, not lawyers.

One caveat before the tables: this is general information, not legal advice, and retention rules change. Verify against your own counsel before destroying anything — particularly anything connected to a pending claim, audit, or investigation.

The Rule That Overrides All the Others

Start here, because it makes everything below conditional.

If you know about a lawsuit, claim, audit, or investigation — or reasonably should expect one — you must preserve everything related to it, regardless of what the retention schedule says. This is a litigation hold, and destroying records under a routine schedule after a hold attaches is not a defense. It is spoliation, and courts treat it badly.

So the schedule tells you the minimum. The hold tells you when the minimum stops applying.

Employment and Payroll Records

This is where most California-specific obligations live, and where the periods got longer in recent years.

• Personnel files, applications, and employment referral records — 4 years. Government Code § 12946, as amended by SB 807: four years after the records are created or received, and — for the personnel files of applicants and terminated employees — four years after the date of the employment action. In practice, run the clock from whichever date is later. This covers documents used to evaluate hiring, promotion, compensation, and discipline.
  Once you receive notice that a verified discrimination complaint has been filed, you must preserve all related records until the later of two dates: after the deadline for filing a civil action has passed, or after the complaint and every related administrative proceeding, civil action, and appeal has finally terminated. A closed agency charge does not by itself end the hold.
• Payroll and time records — 4 years is the safe practice. Labor Code § 1174(d) sets the floor at three years. Keep four: statutory wage claims run three years, but the same underlying conduct is routinely pleaded as an unfair competition claim, which reaches back four — and a record you no longer have is a record you cannot use to defend yourself.
• Wage statements (pay stubs) — 3 years minimum. Labor Code § 226. Same reasoning applies for keeping them four.
• Employee schedules — 4 years, for the same wage-claim-window reason.
• Sexual harassment prevention training records — 2 years.
• Form I-9 — 3 years after hire or 1 year after termination, whichever is later. Federal requirement. Best practice is to keep I-9s in a separate file from the rest of the personnel record, so you can produce them in an audit without handing over everything else.

Workplace Safety Records

• Cal/OSHA Form 300 log, Form 300A summary, and Form 301 incident reports — 5 years. Title 8 CCR § 14300.33 requires retention for “five (5) years following the end of the calendar year that these records cover.” Note the trigger: it runs from year-end, not from the incident date.
• Employee medical and exposure records — significantly longer. If your business involves regulated substances, exposure records can carry 30-year obligations. Check the specific standard that applies to your operation.

Tax Records

Federal and state windows differ, which trips people up.

• IRS — generally 3 years, measured from the later of the return’s due date or the date you actually filed. Six years if you omitted gross income exceeding 25% of what the return reported. No limit at all if a return was never filed or was fraudulent.
• California Franchise Tax Board — 4 years (R&TC § 19057), measured the same way. California’s ordinary audit window is a year longer than the federal one, which is why “keep tax records three years” is bad advice for a California business. California also has its own six-year extension for a 25%-or-more omission of gross income (R&TC § 19058), so four years does not always close the state window either.
• Employment tax records — 4 years after the tax becomes due or is paid, whichever is later.
• Records supporting asset basis — for as long as you own the asset, plus the audit window after you sell it. Purchase documents, improvement receipts, and depreciation schedules for property and equipment routinely need to survive twenty years or more.

Records to Keep Permanently

Some documents have no expiration. Digitize these first — they are the ones you genuinely cannot replace.

• Articles of incorporation or organization, bylaws, and operating agreements
• Corporate minute books, stock ledgers, and ownership records
• Deeds, titles, and property records
• Trademarks, patents, and copyright registrations
• Annual financial statements and general ledgers
• Retirement and pension plan documents
• Insurance policies — particularly liability policies, because claims can surface decades after the policy period
• Records of any environmental issue on a property you own or have owned

Contracts and Business Agreements

California’s statute of limitations is four years for written contracts and two for oral ones, measured from the breach rather than from signing. The practical rule is four years after the contract fully expires, not four years after it was signed — a ten-year lease means fourteen years of retention.

Healthcare Records Are a Separate Question

If you handle patient information, the periods above do not apply. Requirements vary by provider type: general acute care hospitals must retain records at least seven years following discharge (22 CCR § 70751), skilled nursing facilities seven years after discharge (22 CCR § 72543), and licensed primary care clinics — including community and free clinics — seven years (22 CCR § 75055). For all three, records of minors must be held until at least one year past the patient’s eighteenth birthday, and never less than seven years.

Physician practices are covered too. Since January 1, 2024, Business and Professions Code § 2266 makes it unprofessional conduct to fail to keep adequate and accurate patient records for at least seven years after the last date of service. This is a recent change, and a lot of guidance still circulating online predates it. We cover the details in our guide to HIPAA-compliant medical records scanning.

Quick Reference

• 2 years — harassment prevention training records
• 3 years — wage statements (minimum); payroll records (statutory floor); federal tax returns (standard window)
• 4 years — personnel files; payroll and time records (recommended); California tax records; written contracts after expiration
• 5 years — Cal/OSHA injury and illness logs
• 7 years — hospital, skilled nursing facility, and licensed primary care clinic patient records; physician practice records, measured from the last date of service
• Permanent — formation documents, ownership records, deeds, IP, insurance policies, financial statements

How to Actually Run a Purge

Knowing the periods is the easy part. Most businesses stall at the point of applying them, because reviewing a storage room box by box is nobody’s favorite week. A workable approach:

• Write the schedule down first. One page listing each record type your business creates and how long you keep it. This is the document that turns “should we shred this?” from a judgment call into a lookup. It is also what you produce if anyone ever questions why something was destroyed — a consistently applied written policy is defensible in a way that ad hoc decisions are not.
• Confirm no holds are active before anything is destroyed. Check with whoever handles your legal and insurance matters. This takes one email and prevents the only truly bad outcome.
• Sort into three piles, not two. Destroy now, keep permanently, and keep for a defined period. The third pile is the one worth digitizing — you have to keep it, but you do not have to keep it in a room.
• Do the permanent pile first. Formation documents, deeds, insurance policies, and ownership records are irreplaceable and usually in the worst storage conditions. If you only ever digitize one box, digitize that one.
• Destroy securely and document it. Business records past retention still contain employee Social Security numbers, customer financial information, and health data. California law obligates you to dispose of that securely, and a certificate of destruction is the paperwork that proves you did.
• Set a recurring date. A purge you do once is a purge you will need to do again in five years at the same scale. An annual half-day keeps it from rebuilding.

What This Means for Your Storage Room

Two things follow from the list above.

First, a meaningful share of what most businesses are storing is past every applicable retention period and can be destroyed. Companies keep it because reviewing it costs staff time and destroying the wrong thing feels risky, so the boxes stay.

Second, the records that genuinely must be kept forever are the ones sitting in the worst conditions — a mezzanine, a garage, a storage unit with a swamp cooler. Paper does not survive twenty years of that reliably, and originals lost to water or mold are simply gone.

Digitizing changes the economics of both problems. Retention becomes a folder structure and a date field instead of a floor plan. A retention period you can actually enforce means you stop keeping everything by default.

Paperless Revolution scans and indexes business records for offices across Southern California from our facility in Santa Fe Springs. We quote per box, so you can count what you have and know the cost before you start. If part of your archive is past retention, tell us — there is no reason to pay to scan paper you are allowed to shred.

Ask for a written quote.