Payroll Record Retention: Keep the Proof, Control the Deletion
Updated: 5 days ago
A payroll archive earns its value when someone other than the original processor can answer a specific question. Which hours produced this paycheck? Who authorized the new rate? Did the correction reach the employee, the tax return and the general ledger? A folder full of final reports may answer only the first part of that investigation.
Keep payroll records according to their record class, applicable rules and starting dates. Build a small evidence pack around each run, then connect it to restricted employee records and later corrections. Before deleting anything, check the retention requirements, open matters and approved company policy. A period ending creates a review opportunity, not an automatic deletion instruction.
This guide is for U.S. payroll, HR and finance teams designing a usable archive or repairing one before a provider exit. The federal examples below are starting points where the relevant law applies. State requirements, contracts, benefit plans and preservation obligations can change the answer. Have the responsible legal or tax adviser approve your organization's schedule, especially before historical records are removed.
Table of contents
Find the retention clock for the record you actually have
There is no single federal payroll retention period. The same document can support wages, employment taxes and an employment decision. Determine every applicable requirement, then retain it until those requirements and any extensions are satisfied. Do not assign a number solely from the folder's name.
Payroll registers and wage calculation support
Under the FLSA recordkeeping regulations, covered payroll records must be preserved for at least three years from the last entry. Basic time and earnings records have a two-year minimum from their last entry; wage rate tables have a two-year minimum from their last effective date. These distinctions appear in 29 CFR 516.5 and 516.6.
A final register and the timesheets behind it therefore need separate schedule classifications, even if company policy ultimately keeps both longer. Do not destroy calculation support at two years without checking other applicable requirements. A dispute about hours may need the original daily detail, edits and approvals, rather than a pay-period total alone.
Employment tax records and historical credits
The IRS's general employment tax rule is at least four years after the tax becomes due or is paid, whichever is later. Record the relevant due and payment dates instead of starting every clock at the paycheck date. Copies of filed returns, withholding certificates, deposit acknowledgments and supporting wage information belong in the tax record inventory.
Special credit documentation needs its own line. The 2026 Publication 15 says to retain records for qualified sick and family leave wages for leave taken after March 31, 2021, and before October 1, 2021, for at least six years. It says records for Employee Retention Credit qualified wages paid after June 30, 2021, should be kept for at least seven years. Have the tax reviewer establish the applicable starting point and later extensions for the actual claim.
Do not apply a general four-year cleanup rule to those historical credit files. Keep the eligibility analysis, calculation support and claim correspondence connected to the return they support, including later adjustments.
Employment decisions, Form I-9 and leave records
The EEOC generally requires covered employers to retain personnel or employment records for one year, with one year from termination for an involuntarily terminated employee's personnel records. ADEA payroll records have a three-year requirement. Records related to an EEOC charge must remain until final disposition of the charge or resulting lawsuit, including applicable appeals.
For an employer's Form I-9, keep it while the person works for you. After employment ends, compare three years after hire with one year after termination and use the later date. An employee hired March 4, 2025, and terminated August 29, 2026, produces dates of March 4, 2028, and August 29, 2027. March 4, 2028, is the federal retention date to carry into the review, subject to other applicable obligations.
FMLA records required of covered employers have a minimum three-year retention period. Medical certifications and histories created for FMLA purposes must be confidential and separate from ordinary personnel records. Payroll may need leave dates and pay effects; that does not justify giving every payroll reviewer access to medical detail.
Add the jurisdiction and special-purpose layer
Check the rules for where employees work and the record involved. For example, New York Labor Law section 661 requires at least six years of payroll records for employees covered by that article. A federal three-year register rule alone would not satisfy that requirement.
Keep benefit-plan, grant, public-contract, immigration and occupational-health records on their relevant schedules. This guide is not a complete retention table for those categories. Identify them during classification so an ordinary payroll cleanup cannot quietly dispose of a specialized file.
If your archive problem begins with reports you cannot reliably export, bring a list of the missing records to a free SelectSoftware Reviews advisor consultation. Compare potential payroll systems against the record types and access your archive requires.
Make a retention schedule executable by another person
A schedule that says only “payroll: seven years” leaves critical decisions unresolved. Which records does payroll include? When does the period begin? Who knows whether a matter is still open? The operational schedule needs enough detail for a backup owner to make the same classification without guessing.
Start with a handful of classes: final payroll outputs, time and calculation support, employee change authorizations, tax filings and payments, restricted employment records, and accounting support. Split a class when its rule, trigger, access or disposition process differs. A tax credit claim should not inherit an ordinary register rule merely because both relate to the same quarter.
For each class, name the controlling sources, minimum periods and trigger events. Add the approved company retention period, archive location, owner and backup. If multiple rules apply, preserve their separate dates and identify the latest currently controlling requirement. A single calculated date without its inputs is difficult to review after a rule changes.
Use an event you can prove. A “last entry” date is not necessarily when a report was downloaded. A wage table's last effective date is not its file-creation date. Keep the source event and the evidence supporting it, then calculate the review date consistently. If a trigger is unknown, route that entry for investigation rather than filling in a convenient date.
Separate a legal minimum from an organizational choice. A company might retain a run's supporting documents longer to answer finance or contractual requests, but that decision needs an owner and rationale. Indefinite retention increases the volume of sensitive data you must protect and search.
Review the schedule when jurisdictions, record types, contracts or systems change. Record which version governed an approved disposition so a later reviewer can understand the decision made at the time.
Build an evidence pack around the question the run must answer
A run pack is an index of the evidence needed to explain payroll. It need not be a single oversized PDF or a duplicate copy of every HR record. Use a stable run ID to connect approved inputs, final calculations, outcomes and unresolved exceptions. Preserve the underlying records in the locations and formats their rules require.
The final register identifies the approved calculation. Capture the version used for release, the pay date, entity, pay period and population. Add control totals that matter to your operation, such as gross pay, net pay, taxes and major deduction categories. A regenerated report can differ after a later correction, so identify whether the saved export represents the original release or a revised view.
For inputs, retain or reference approved time, rate changes, relevant deduction instructions and exception decisions. Link a change to its authorization and effective date. A report showing the new rate proves what the system contained; it does not establish who authorized that change. Sensitive source records can remain in restricted storage, with a controlled reference in the run index.
For outcomes, collect the available payment status, rejected or returned payment information, and relevant confirmations. Treat a submission acknowledgment as submission evidence. Record a later acceptance or settlement result separately when available. The payroll register, bank debit and tax filing receipt describe different events; one cannot stand in for all three.
For accounting, connect the final payroll output to the posting file, mapping version and reconciliation explanation. If one run produces several posting batches, list them. If a month-end accrual includes payroll estimates, retain the assumption and reversal trail with the close support. Finance should be able to locate the bridge without opening every employee record.
Finish the index with exceptions still open at archive time. Record the issue, affected run or employee reference, responsible person and next expected evidence. An archive can contain a complete account of an unresolved incident. It should not label that incident resolved because the payroll folder has been filed.
A compact run-pack contents list
Copy these checks into the run index. They describe a recommended operating pack, not a universal statutory list.
☐ Identity and final version: entity, period, pay date, run ID, population and approved register version are recorded.
☐ Inputs and authorization: time, changes and exceptions can be traced to their approved source or restricted reference.
☐ Outcomes: payment, filing or deposit evidence is identified by event and status, with missing confirmations assigned.
☐ Accounting and follow-up: posting support, reconciliation notes and later correction references are connected.
Figure 1. A common run ID makes the evidence traceable; it does not make every record suitable for the same access permissions or retention period.
Preserve the original when a correction changes the story
Keep the original released result and identify the correction as a later event. Replacing an old register with a corrected register can remove the evidence of what the employee actually received first. Conversely, keeping both without a relationship can make a reviewer believe the same amount was paid twice.
Give the correction its own reference and connect it to the original run, authorization, calculation, payment and any downstream reporting. Record what changed and what stayed unchanged. If a corrected amount appears in the next regular payroll, identify that run. If it was paid separately, identify the separate payment and the way it appears in later reports.
Consider a fictional missed shift premium. The original run excluded the premium; an approved correction later paid $84. The evidence pack should preserve the original calculation, the corrected hours or premium support, approval, the $84 payment reference and the resulting reporting treatment. It should explain whether a later cumulative register includes the $84, rather than inviting someone to add the original and cumulative totals together.
If the correction leads to amended returns or accounting adjustments, add their references as those steps occur. Do not mark an amended filing accepted merely because the payroll correction was completed. Each outcome has its own evidence and owner. A tax professional should determine the required filing treatment; the archive preserves the decision and its execution.
Where a source record is missing, describe the gap honestly. A reconstruction memo can explain which available evidence was used, who prepared it and what remains uncertain. It does not transform a recollection into a contemporaneous approval. Preserve recovered originals when they become available and connect them to the memo without silently rewriting its history.
Give the archive useful access without exposing the whole workforce
Use restricted storage for payroll details, bank instructions, identity records and other sensitive documents. A broadly shared evidence index can carry a run ID, status and controlled link without containing full Social Security numbers or bank account details. Make access to the underlying evidence a deliberate permission, rather than a side effect of joining the finance folder.
Match access to the task. A controller investigating an aggregate posting difference may need a reconciliation file and selected employee-level support. A manager reviewing hours ordinarily needs records for the people they supervise. The archive administrator needs to maintain storage and recovery; that role should not automatically confer permission to approve payroll changes or destroy records.
Name a backup owner with independently usable access. Test that person's account instead of assuming a shared login will remain available. Remove obsolete user access when responsibilities change, while preserving authorized access to the organization's records. Separate access removal from record deletion in the departure checklist.
Keep confidential medical files in their required separate location. Likewise, make I-9 retrieval a defined process with appropriate access, rather than embedding immigration documents in a widely accessible payroll run pack. Record references where needed without duplicating protected detail into less restricted copies.
Ask IT to distinguish a working archive, backup and provider portal. A backup is useful for recovery, but it may not offer the indexing, permissions or timely retrieval required for routine requests. An archive also needs a recovery method when the primary storage fails. Agree who can restore it, how permissions survive restoration and how a preservation instruction reaches backup administrators.
Use the Payroll Record Decision Log to control each class
Create one entry for a record class or a clearly bounded batch with the same rules and trigger. For mixed batches, split the entry. Copy the fields below into notes or a shared register; keep sensitive identifiers in the restricted record, not in a public working sheet.
Classification and clock
Record class and batch: ______. Name the actual record, employer entity, jurisdiction, period and source system. “Old payroll files” is not a sufficiently bounded batch.
Purpose and required evidence: ______. State what the record establishes and which linked records are needed to interpret it.
Rules and approved policy: ______. Record the source, applicable minimum, company period and schedule version. List multiple applicable requirements separately.
Trigger evidence and calculated dates: ______. Identify the event date for each rule, the evidence supporting that date and each resulting minimum retention date. Select the latest currently applicable date as the earliest review point.
Custody and preservation
Archive location and format: ______. Include the durable location, original or export format, readable-view format and any source-system dependency.
Owner, backup and access: ______. Name who maintains the entry, who can retrieve the records and who approves disclosure or disposition.
Open matters and extensions: ______. Record preservation instructions, tax notices, disputes, audits, contractual needs or unresolved questions. Include the responsible reviewer and the date the status was checked.
Review and outcome
Review result and next action: ______. Choose KEEP when a known requirement, hold or approved policy still calls for retention; INVESTIGATE when a rule, trigger or preservation status needs an answer; or ELIGIBLE FOR DISPOSITION REVIEW when all recorded retention dates have been reached and review confirms no outstanding preservation matter. State the remaining condition and next review date. The last status does not authorize deletion.
Authorization and completion evidence: ______. After approval, record the authorized scope, approver, method, completion date, systems addressed and any deferred copies or backups. If approval is withheld, preserve that decision and its reason.
A filled clock example
Assume a fictional employment tax batch has a verified tax due date of April 30, 2025, and payment date of May 15, 2025. These are inputs supplied for the example, not a claim that every payroll tax was due on April 30. The general four-year calculation uses May 15, giving May 15, 2029, as its minimum retention date.
The entry still needs the applicable state and special-credit checks, approved company policy and open-matter review. If an applicable requirement produces a later date, or a preservation instruction applies, May 15, 2029, cannot authorize disposal. The owner records KEEP and the controlling reason instead.
For I-9s, calculate hire and termination anniversaries separately; for an active employee, do not schedule disposal just because three years after hire has arrived. The record class determines the calculation. Reusing a spreadsheet formula from another class can produce a precise but incorrect date.
When comparing replacement software, use the record classes in your log to ask about historical exports, role access and post-contract retrieval. Set those requirements before a free SelectSoftware Reviews consultation so the payroll software shortlist reflects your archive needs.
Rehearse retrieval before a real request sets the deadline
Run a small retrieval drill with an authorized backup owner. Choose a normal run, a later correction and a tax or employee-change question. Include one older period, so the exercise tests the archive rather than records still visible on the current dashboard. Use fictional or appropriately restricted cases when wider training would expose personal data.
Give the reviewer a question, not a folder location: “Explain this employee's corrected gross pay and identify the payment,” for example. Record the start time, the required evidence and where the reviewer became stuck. A ten-minute target can be a useful internal diagnostic, but it is not a legal response deadline or a benchmark this guide has measured.
Check content as well as speed. A retrieved file can be readable but belong to another entity, a preview run or the wrong pay date. Have the reviewer identify the final version, source approvals and unresolved items. Verify that exported files open with software available to the backup owner, not just on the original processor's machine.
Classify failures into missing evidence, a broken reference, denied access, an unreadable format or ambiguous versions. Assign a correction to the person who can fix that failure. Buying more storage will not repair a missing authorization; renaming files will not restore an export that was never captured.
Repeat the failed case after the correction. A screenshot that permissions changed is weaker than the backup owner successfully retrieving the required record. Record the result and any remaining gap. Set a cadence appropriate to the volume and risk, with an additional drill after a provider exit, storage move or archive-owner change.
Employee and agency requests can have their own disclosure and timing requirements. Route a real request to the designated HR, legal or tax reviewer promptly. Provide the authorized scope through a controlled channel and record what was supplied.
Arrange provider exit around records, not the final login
Before a contract ends, obtain the actual export inventory and access terms. Ask which record types can be exported, whether approvals and edit histories are included, what formats are available, what historical periods remain accessible, and what happens after termination. Get the relevant commitment in the agreement or written service confirmation.
Do not assume the new provider will import every historical document. Separate the data needed to operate the new payroll from the evidence needed to explain the old payroll. The archive may retain original reports and authorizations that have no destination field in the new system. Carry the old-to-new employee and entity identity crosswalk so historical searches remain meaningful.
Prioritize gaps that can become irrecoverable: source time detail, historical rate tables, deduction instructions, release approvals, returned payments, filed returns and acknowledgments. Download a bounded sample early and open it outside the portal. Check whether hyperlinks still work after logout and whether exports include all pages, entities and periods requested.
Preserve original machine-readable exports where useful, alongside a readable view and report definition. Record filters, generation dates and whether the export was taken before or after a correction. A PDF may be convenient for reading; it is not automatically a substitute for every legally required record or for data needed to investigate a difference.
Reconcile the export inventory to the expected history and log omissions. Assign someone to resolve them while support access remains available. The archive acceptance should require a successful independent retrieval and recovery check, not only a provider message that a download was generated.
Approve disposition without losing control of copies
When a batch reaches its review date, confirm the current schedule and all applicable requirements again. Check whether a dispute, tax notice, investigation or preservation instruction covers the batch. An EEOC charge can require related records beyond the named employee, so have the appropriate reviewer define scope and release any hold; payroll should not infer that a closed help-desk ticket ends a legal matter.
Pause deletion when the controlling date or preservation status is unclear. Record the question, its owner and the next review date. Keeping an uncertain batch temporarily is a different decision from setting an undocumented permanent retention rule.
Figure 2. Completion records cover working copies, exports and backups under the approved scope.
Approved disposition needs a bounded scope and a method appropriate to the data. Include working copies, exports and locally saved files in the inventory. Ask IT how replicas, backups and provider-held copies are handled under the applicable retention and preservation requirements. Do not promise immediate deletion from every backup if the architecture cannot deliver it; document deferred handling and prevent an ordinary restore from recreating records scheduled for disposition.
Keep a disposition record with the batch, governing schedule version, approvals, method, completion evidence and exceptions. A disposal log explains a past action; it is not evidence that an earlier retention decision was legally correct. Retain the log under its own approved schedule and restrict sensitive detail.
Start with one recent run and one older batch. Prove that the recent run is explainable, then classify the older batch before authorizing any cleanup. A small team can begin with controlled folders and a maintained index. A larger operation with several entities, frequent requests or automated deletion jobs may need dedicated records-management controls. Choose based on who can maintain the rules, recover the records and stop disposal when conditions change.
If current payroll software leaves those export or access requirements unresolved, take the specific gaps into a free SelectSoftware Reviews advisor conversation. Ask each shortlisted provider for evidence of the relevant workflow and its contractual boundaries.
Continue with Payroll Operations & Controls, the payroll templates library or all Decision Guides.
About the author
Ben Scott writes and maintains payroll decision guides for founders and operators. His work focuses on execution realities and how decisions hold up under growth, complexity, and controls and documentation pressure. He works hands-on in HR and leave-management roles that intersect with payroll-adjacent workflows such as benefits coordination, cutovers, and compliance-driven process controls.
