Recordkeeping Requirements: How Long to Keep Time and Payroll Records by State

Lose the time records and you lose the wage-hour case — the Supreme Court has held since 1946 that inadequate employer records flip the burden onto the employer to disprove the employee's reasonable inference.

The Fair Labor Standards Act delegates the recordkeeping duty to one statute (29 USC §211(c)) and one set of regulations (29 CFR Part 516). The statute requires employers to "make, keep, and preserve" wage and hour records; the regulations spell out the twelve specific records that must be maintained for every non-exempt employee, the three-year window for payroll records, the two-year window for the underlying time cards, and the seventy-two-hour-on-demand production rule.

The doctrinal hinge is Anderson v. Mt. Clemens Pottery Co., 328 U.S. 680 (1946). When the employer fails the §211(c) duty, the employee's burden drops to "just and reasonable inference" and the employer is left with no records to rebut it. Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016), extended Mt. Clemens to representative evidence at class certification, producing a $2.9 million jury verdict doubled to roughly $5.8 million in final FLSA recovery.

State law adds longer windows and statutory penalties. New York, New Jersey, and Hawaii require six-year retention for wage-and-hour records. California requires three years under Labor Code §1174 and adds a $750 statutory penalty under Labor Code §226(f) for failure to honor a records request within twenty-one days. Colorado imposes up to $250 per employee per month under C.R.S. §8-4-103(4.5). Federal layered statutes — IRS four-year, ERISA six-year, OSHA five-year, EEOC one-year-extending-during-charge — stack on top of the FLSA floor.

Skip to the state-by-state table →

Quick reference

Federal payroll retention: 3 years for the §516.2(a) payroll list (29 CFR §516.5).
Federal time-card retention: 2 years for the underlying daily start/stop records and wage-rate tables (29 CFR §516.6).
Federal place-of-records rule: records must be produced within 72 hours of a DOL demand at a central recordkeeping office (29 CFR §516.7).
Longest state retention: New York, New Jersey, and Hawaii — 6 years (NY Lab. Law §195(4); N.J.A.C. Title 12, Chapter 2, Appendix A; HRS §387-6 plus DLIR rule).
States with statutory inspection penalties: California ($750 under Lab. Code §226(f)); Colorado ($250/employee/month, $7,500 cap under C.R.S. §8-4-103(4.5)); Washington ($250/$500/$1,000 graduated under RCW 49.12.250).
Federal SOL: 2 years FLSA, 3 years for willful violations (29 USC §255(a)).
State SOL outliers: New York 6 years (NYLL §198(3)); California 4 years for UCL derivative claims (Bus. & Prof. Code §17208); Massachusetts 3 years with mandatory treble damages (MGL c.151 §1B).
Layered federal retention: IRS employment-tax 4 years (Treas. Reg. §31.6001-1); ERISA benefit-plan 6 years (29 USC §1027); OSHA injury logs 5 years (29 CFR §1904.33); EEOC personnel records 1 year extending during a charge (29 CFR §1602.14); FMLA 3 years (29 CFR §825.500).
Anchor cases: Anderson v. Mt. Clemens Pottery Co., 328 U.S. 680 (1946); Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016); Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y. 2003).

The 5 most expensive recordkeeping mistakes

Keeping only the rounded weekly total. The rounded total is a derived record. The underlying punch-by-punch detail is what 29 CFR §516.6(a) protects for two years as "supplementary basic records" — "all basic time and earning cards or sheets on which are entered the daily starting and stopping time of individual employees." Employers who keep only the rounded weekly total have destroyed the source-of-truth for any rounding-rule challenge, and Mt. Clemens will treat the rounded number as inadequate to rebut a "just and reasonable inference" of unpaid time. The exposure runs at 1.5× the regular rate for all hours over forty, doubled by liquidated damages under 29 USC §216(b), reaching three years under the willful-violation window at 29 USC §255(a).
Cloud migration without retrieval testing. 29 CFR §516.7 requires records at a central office to be produced within seventy-two hours of a DOL demand. The post-migration failure pattern: vendor subscription lapsed, admin credentials lost, or audit-export tooling incompatible with the new vendor. The DOL treats the production failure as a §211(c) violation independent of any underlying wage-hour issue. Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016), expanded Mt. Clemens into the class-certification context — a $2.9 million jury verdict doubled to roughly $5.8 million in final recovery, made possible because Tyson kept no donning-and-doffing time records.
California's 21-day window blown. Labor Code §226(c) requires production of records within twenty-one calendar days of a written or oral request. §226(f) provides a $750 statutory penalty for each failure, recoverable by the employee or the Labor Commissioner. The penalty stacks per affected employee. A two-hundred-employee class with a missed twenty-one-day window produces $150,000 in §226(f) penalties before the underlying wage-hour claim is reached. Bus. & Prof. Code §17208 extends the UCL window to four years, so the records must support a four-year reach-back in California — one year beyond the §1174 floor.
Misclassified exempt with no time records. 29 CFR §516.3 reduces the recordkeeping load for bona fide §13(a)(1) exempt employees — the regular-rate and hour-by-hour items at §516.2(a)(6)–(a)(10) are dropped. When the exemption fails (the most common scenario for the highly compensated daily-rate worker after Helix Energy Solutions Group v. Hewitt, 598 U.S. 39 (2023)), the employer has no time records, the workweek hours are unknown, and Mt. Clemens converts the misclassified worker's reasonable estimate into the operative record. New York's six-year window under NYLL §195(4) and §661 means the reach-back triples a federal three-year exposure.
Spoliation after the litigation hold attached. The duty to preserve attaches when the employer knows or reasonably should know that litigation is probable — not when the complaint is filed. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y. 2003), set the framework. Federal Rule of Civil Procedure 37(e), as amended in 2015, distinguishes negligent loss (lesser sanctions) from intentional deprivation (adverse-inference instructions, case-dispositive sanctions). A demand letter, DOL audit notice, or pre-litigation EEOC charge triggers the hold; routine three-year-rotation deletion that destroys responsive records after the trigger is sanctionable spoliation that overrides any regulatory retention window.

The federal floor

29 USC §211(c) — the recordkeeping mandate

29 USC §211(c) requires that "every employer subject to any provision of this chapter or of any order issued under this chapter shall make, keep, and preserve such records of the persons employed by him and of the wages, hours, and other conditions and practices of employment maintained by him, and shall preserve such records for such periods of time, and shall make such reports therefrom to the Administrator as he shall prescribe by regulation or order as necessary or appropriate for the enforcement of the provisions of this chapter or the regulations or orders thereunder."

The statute itself does not list the records or specify the retention period. Both are delegated to the Wage and Hour Administrator, who issued 29 CFR Part 516.

29 CFR §516.2(a) — the twelve required items

For every non-exempt employee, the covered employer must maintain:

Name in full, as used for Social Security recordkeeping purposes, and any identifying symbol or number used in place of name on time, work, or payroll records.
Home address, including zip code.
Date of birth, if under 19.
Sex and occupation in which employed.
Time of day and day of week on which the employee's workweek begins (or for §7(k) employees, the starting time and length of each work period).
Regular hourly rate of pay for any workweek in which overtime is due under §7(a); the basis of pay (per hour, per day, per week, per piece, commission on sales, or other basis); and the amount and nature of each payment excluded from the regular rate under §7(e).
Hours worked each workday and total hours worked each workweek.
Total daily or weekly straight-time earnings or wages due for hours worked, exclusive of premium overtime compensation.
Total premium pay for overtime hours.
Total additions to or deductions from wages paid each pay period.
Total wages paid each pay period.
Date of payment and the pay period covered by payment.

Item (7) — "hours worked each workday and total hours worked each workweek" — is the load-bearing item for any off-the-clock or time-clock-rounding challenge. The regulation requires the actual hours, not the rounded total. Item (6) is the load-bearing item for any regular-rate or overtime-misclculation challenge.

29 CFR §516.3 — exempt employees

For bona fide executive, administrative, professional, and outside sales employees exempt under §13(a)(1), the employer must keep all §516.2(a) items EXCEPT items (6)–(10) — the hour-by-hour and regular-rate items. The employer must additionally record the basis on which wages are paid in sufficient detail to permit calculation of total remuneration including fringe benefits.

The operational effect: for properly exempt employees, no time records are required. For misclassified employees who turn out non-exempt, no time records exist — the textbook Mt. Clemens setup.

29 CFR §516.5 — three-year retention

Three categories must be preserved for at least three years from the last date of entry:

Payroll records containing the employee data required under §516.2 (the twelve-item list) and §516.3 (the exempt-employee list).
Certificates, agreements, plans, notices, and similar documents — including collective bargaining agreements, written employment contracts, trusts, plans, and written memoranda summarizing the terms of oral agreements.
Sales and purchase records — total dollar volume of sales or business and total volume of goods purchased or received during applicable periods (relevant to FLSA §3(s)(1)(A)(ii) coverage).

29 CFR §516.6 — two-year retention

Three categories must be preserved for at least two years:

Supplementary basic records: all basic time and earning cards or sheets on which are entered the daily starting and stopping time of individual employees, or of separate work forces; and all wage rate tables or schedules of the employer providing the piece rates or other rates used in computing straight-time earnings, wages, or salary, or overtime pay.
Order, shipping, and billing records: originals or true copies of all customer orders or invoices received, incoming or outgoing shipping or delivery records, and bills of lading.
Records of additions to or deductions from wages: individual employee records relating to §516.2(a)(10), plus the records used in determining the original cost, operating and maintenance cost, and depreciation and interest charges relevant to additions or deductions.

The structural distinction: the rounded weekly total goes in the three-year bucket (§516.2(a)(7) → §516.5). The underlying punch-by-punch time cards go in the two-year bucket (§516.6(a)). The two windows are different. The two-year window on raw punches is the operational trap — an employer who keeps only the rounded total has destroyed the Mt. Clemens defense after year two.

29 CFR §516.7 — place of records and 72-hour production

"Each employer shall keep the records required by this part safe and accessible at the place or places of employment, or at one or more established central recordkeeping offices where such records are customarily maintained. Where the records are maintained at a central recordkeeping office, other than in the place or places of employment, such records shall be made available within 72 hours following notice from the Administrator or a duly authorized and designated representative."

The regulation explicitly contemplates centrally-stored and electronic records. The operative constraint is the seventy-two-hour-on-demand window. Cloud-hosted records satisfy §516.7 if the employer can retrieve and produce within that window. They do not satisfy it if the employer has lost vendor credentials, let a subscription lapse, or otherwise cannot produce on demand.

DOL Fact Sheet #21

The DOL's plain-English summary of Part 516 confirms the three-year payroll / two-year supporting-records framework and lists the §516.2(a) items in narrative form. It is the auditor's checklist in WHD investigations and confirms that "the Act requires no particular form for the records, but does require that the records include certain identifying information about the employee and data about the hours worked and the wages earned." The FLSA does not require an itemized pay stub — the federal duty is to maintain records, not deliver a statement to the employee.

29 USC §255(a) — statute of limitations

"May be commenced within two years after the cause of action accrued ... except that a cause of action arising out of a willful violation may be commenced within three years after the cause of action accrued."

The willful-violation window means a court may demand year-three time cards the employer never legally had to keep under §516.6. Practitioner standard: retain time cards three years, not two, to match the maximum reach-back.

Anderson v. Mt. Clemens Pottery Co. — the doctrinal hinge

Anderson v. Mt. Clemens Pottery Co., 328 U.S. 680 (1946), is the single most-cited case in federal wage-and-hour litigation. Pottery workers sued under the FLSA for unpaid pre-shift walking time and post-shift cleanup. The employer kept no records of the contested time. The Supreme Court held:

"An employee has carried out his burden if he proves that he has in fact performed work for which he was improperly compensated and if he produces sufficient evidence to show the amount and extent of that work as a matter of just and reasonable inference. The burden then shifts to the employer to come forward with evidence of the precise amount of work performed or with evidence to negative the reasonableness of the inference to be drawn from the employee's evidence."

The mechanism: when the employer fails the §211(c) duty, the employee's burden of proof drops to "just and reasonable inference," and the employer — who lacks records — has no way to rebut. Effectively, missing records flip the burden.

Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016), extended Mt. Clemens into the class-certification context. Pork-processing workers at Tyson's Iowa plant performed uncompensated donning and doffing time; Tyson kept no records of the donning or doffing minutes. Plaintiffs used a Dr. Mericle study averaging observed donning/doffing time as representative evidence for the class. The jury returned a verdict of $2,892,378.70 in compensatory damages, doubled by liquidated damages to a $5,785,757.40 final judgment. The Eighth Circuit affirmed. The Supreme Court (Kennedy, J.) held that representative evidence is admissible at class certification when the employer's recordkeeping failure makes individualized proof impractical:

"When employers violate their statutory duty to keep proper records, and employees thereby have no way to establish the time spent doing uncompensated work, the remedial nature of this statute and the great public policy which it embodies militate against making that burden an impossible hurdle for the employee."

The practical effect: Mt. Clemens, formerly an individual-claim doctrine, becomes the class-certification doctrine. Small per-employee claims become large class claims when records are absent.

California — three years statute, four years practice, $750 inspection penalty

California Labor Code §1174 sets the recordkeeping duty:

"Every person employing labor in this state shall ... keep, at a central location in the state or at the plants or establishments at which employees are employed, payroll records showing the hours worked daily by and the wages paid to, and the number of piece-rate units earned by and any applicable piece rate paid to, employees employed at the respective plants or establishments. These records shall be kept in accordance with rules established for this purpose by the commission, but in any case shall be kept on file for not less than three years."

Section 1174 also forbids the employer from prohibiting an employee from maintaining a personal record of hours worked — a statutory acknowledgment of the Mt. Clemens dynamic.

The required records mirror 29 CFR §516.2(a): names, addresses, ages, hours worked daily, wages paid, and piece-rate compensation if applicable. Labor Code §1175 makes failure to keep §1174 records a misdemeanor.

Labor Code §226(c) — the 21-day inspection rule — is separate from §226(a)'s pay-stub itemization list:

"An employer who receives a written or oral request to inspect or receive a copy of records pursuant to subdivision (b) ... shall comply with the request as soon as practicable, but no later than 21 calendar days from the date of the request."

§226(f) carries the penalty:

"A failure by an employer to permit a current or former employee to inspect or receive a copy of records within the time set forth in subdivision (c) entitles the current or former employee or the Labor Commissioner to recover a seven-hundred-fifty-dollar ($750) penalty from the employer."

California's UCL — Business & Professions Code §17208 — carries a four-year statute of limitations:

"Any action to enforce any cause of action pursuant to this chapter shall be commenced within four years after the cause of action accrued."

Practitioner standard for California: retain payroll records four years, not three, to cover UCL derivative claims. The §1174 three-year minimum is the floor; the §17208 four-year UCL window is the operative limit on reach-back.

Things employers consistently miss

The 21-day clock starts on oral request. §226(c) covers "a written or oral request." A verbal request during exit conversation triggers the clock; many employers wait for a written demand and miss the window.
Former employees count. §226(c) extends inspection rights to former employees on the same terms; the penalty in §226(f) applies to "current or former employee."
The penalty is per request, not per pay period. Unlike §226(e) wage-statement penalties (per pay period up to $4,000), §226(f) is a flat $750 per failure to honor the request. Aggregation comes from class size, not from pay-period multiplication.
Personal records cannot be prohibited. §1174's prohibition on employer interference with personal hour-tracking is rarely litigated but is the statutory hook for the Mt. Clemens-style reasonable inference when the employer's records are inadequate.
Wage Order recordkeeping rules layer on top of §1174. IWC Wage Order 5(a) requires meal-period records for non-exempt employees. Donohue v. AMN Services, LLC, 11 Cal. 5th 58 (2021), holds that a time record showing a missed, short, or late meal period creates a rebuttable presumption of a violation, rebuttable only with records — Mt. Clemens logic applied to break records.

State-by-state table

State	Retention	Cite	Notable
Alabama	3 years (federal default)	29 CFR §516.5	No state-specific statute
Alaska	3 years	AS 23.05.080; 8 AAC 15.165	Mirrors federal
Arizona	4 years	A.R.S. §23-364(D)	Min-wage records retention runs 4 years
Arkansas	3 years (federal default)	29 CFR §516.5	No state-specific retention
California	3 years (4 per UCL)	Lab. Code §1174; §1175; §226(c)–(f)	$750 inspection penalty; 21-day rule
Colorado	3 years	C.R.S. §8-4-103(4.5); 7 CCR 1103-1	$250/emp/mo penalty; $7,500 cap
Connecticut	3 years	C.G.S. §31-66; Conn. Agencies Regs. §31-60-12	Records at place of employment
Delaware	3 years	19 Del. C. §911	Mirrors federal
DC	3 years or federal	D.C. Code §32-1008	Whichever is greater
Florida	3 years (federal default)	29 CFR §516.5	No state-specific retention
Georgia	3 years (federal default)	29 CFR §516.5	No state-specific retention
Hawaii	6 years	HRS §387-6; DLIR rule	Tied with NY and NJ as longest
Idaho	3 years (federal default)	29 CFR §516.5	No state-specific retention
Illinois	3 years	820 ILCS 105/9; 820 ILCS 115/10	Wage Payment + Min Wage parallel
Indiana	3 years	IC 22-2-2-8; 31 IAC 5-7-9	31 IAC 5-7-9 sets 3-year rule
Iowa	3 years	Iowa Code §91A.6	Wage Payment + Collection Law
Kansas	3 years	K.S.A. §44-1209	Mirrors federal
Kentucky	1 year (state); 3 years (federal default)	KRS §337.320	State min is shorter than federal
Louisiana	3 years (federal default)	29 CFR §516.5	No state-specific retention
Maine	3 years	26 MRS §665	Mirrors federal
Maryland	3 years	LE §3-424	Race/gender also required
Massachusetts	3 years	G.L. c. 151 §15	Mandatory treble damages (c.151 §1B)
Michigan	3 years	MCL §408.479	Workforce Opportunity Wage Act
Minnesota	3 years	Minn. Stat. §177.30	8 specific categories required
Mississippi	3 years (federal default)	29 CFR §516.5	No state-specific retention
Missouri	3 years	RSMo §290.520	Mirrors federal
Montana	3 years	MCA §39-3-409	Mirrors federal
Nebraska	3 years (federal default)	29 CFR §516.5	No state-specific retention
Nevada	2 years	NRS §608.115	State shorter than federal payroll
New Hampshire	3 years (federal default)	29 CFR §516.5	No state-specific retention
New Jersey	6 years	NJSA §34:11-4.6; 12:55-2.1	NJ Wage Payment Law 6-year rule
New Mexico	1 year (state); 3 years (federal default)	NMSA §50-4-9	State min shorter than federal
New York	6 years	NY Lab. Law §195(4); §661	$50/$250 wage-notice penalties under §198(1-b), (1-d); 6-year SOL under §198(3)
North Carolina	3 years	NCGS §95-25.13; 13 NCAC 12 .0802	Implementing rule sets retention
North Dakota	3 years (federal default)	29 CFR §516.5	No state-specific retention
Ohio	3 years	ORC §4111.08; Ohio Const. Art. II §34a	Constitutional amendment ext. requirements
Oklahoma	3 years (federal default)	29 CFR §516.5	No state-specific retention
Oregon	2 years statute; 3 years agency	ORS 653.045; OAR 839-020-0080	Statute 2y; BOLI applies 3y
Pennsylvania	3 years	43 P.S. §333.108; 34 Pa. Code §231.31	Retention from date of last entry
Rhode Island	3 years	R.I.G.L. §28-12-13	Mirrors federal
South Carolina	3 years (federal default)	29 CFR §516.5	No state-specific retention
South Dakota	3 years (federal default)	29 CFR §516.5	No state-specific retention
Tennessee	3 years (federal default)	29 CFR §516.5	No state-specific retention
Texas	4 years (UI)	TWC Rule 815.106; Tex. Lab. Code Ch. 61	TWC 4-year UI standard controls
Utah	3 years (federal default)	29 CFR §516.5	No state-specific retention
Vermont	3 years	21 V.S.A. §393	Mirrors federal
Virginia	3 years	Va. Code §40.1-29.2	Mirrors federal
Washington	3 years	RCW 49.46.070; WAC 296-126-050	21-day personnel-file rule under RCW 49.12.250
West Virginia	2 years	W. Va. Code §21-5C-5	State shorter than federal payroll
Wisconsin	3 years	DWD §272.11	Mirrors federal
Wyoming	3 years (federal default)	29 CFR §516.5	No state-specific retention

The six-year states — New York, New Jersey, and Hawaii

New York — NY Labor Law §195(4) and §661

NY Lab. Law §195(4) requires every employer to "establish, maintain and preserve for not less than six years contemporaneous, true, and accurate payroll records showing for each week worked the hours worked; the rate or rates of pay and basis thereof, whether paid by the hour, shift, day, week, salary, piece, commission, or other; gross wages; deductions; allowances, if any, claimed as part of the minimum wage; and net wages." For non-exempt employees, records must also include regular and overtime rates and hours worked at each. For piece-rate workers, records must include the applicable rates and the number of pieces completed.

NY Lab. Law §661 — the minimum-wage chapter — provides a parallel six-year retention requirement for minimum-wage records.

The six-year window matches the six-year statute of limitations under NY Lab. Law §198(3). Combined with §198(1-b)'s $50-per-workday wage-notice penalty (up to $5,000 per employee) and §198(1-d)'s $250-per-workday wage-statement penalty (up to $5,000 per employee), inadequate recordkeeping in New York produces large statutory recoveries even absent an underlying wage-hour violation. The regulatory and litigation windows are coterminous.

New Jersey — Wage Payment Law and Wage and Hour Law notice

New Jersey's employer recordkeeping notice under N.J.A.C. Title 12, Chapter 2, Appendix A requires wage-and-hour records for each employee to include the employee's name, address, birth date if under eighteen, total hours worked each day and workweek, earnings, deductions, basis of pay, and gratuity or food-and-lodging records where applicable.

The notice requires employers to keep those wage-and-hour records for six years and to keep them at the place of employment or in a central office in New Jersey. New Jersey is therefore part of the strictest six-year group, with the same six-year period as NY/HI.

Hawaii — HRS §387-6 plus DLIR rule

HRS §387-6 requires every employer to keep a contemporaneous, true, and accurate record of names, addresses, occupations, hours worked each day and each workweek, rates of pay, gross wages, deductions, allowances, and net wages, "and any other information and for the periods of time as the director may by rule prescribe."

The Hawaii Department of Labor and Industrial Relations Wage Standards Division applies a six-year retention period by rule under the §387-6 delegation. Hawaii is part of the six-year-retention group, paired with New York and New Jersey at the long end of the state distribution.

Industry-specific rules

Trucking — 49 CFR §395.8(k): six-month HOS records

The federal Hours of Service regulation at 49 CFR §395.8(k) provides: "A motor carrier shall retain records of duty status and supporting documents required under this part for each of its drivers for a period of not less than 6 months from the date of receipt."

The six-month HOS retention is substantially shorter than the FLSA payroll window. The FLSA §516 payroll obligation still applies on top, so a motor carrier owes three years for payroll, two years for time cards, AND six months for HOS records of duty status (RODS) — which may double as the time card. Drivers carry the previous seven consecutive days of RODS while on duty.

The ELD mandate (effective December 18, 2017; full enforcement April 1, 2018) replaced paper RODS with electronic logging devices for most interstate drivers. The ELD records satisfy §395.8(k) electronically; the carrier must produce them on demand to FMCSA or state DOT roadside inspectors.

Healthcare — HIPAA's six years is not the FLSA window

45 CFR §164.530(j) requires a covered entity to "retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later."

The six-year retention applies to policies, procedures, written communications, and documented compliance actions — the privacy and security program records. It does not apply to time-and-attendance or payroll records, which remain under FLSA §516 (three years payroll, two years time cards).

The conflation trap: healthcare HR managers commonly assume "six years HIPAA" applies to time-and-attendance. It does not. HIPAA covers protected-health-information handling documentation, not employee time-card data. The §516 windows apply to time data; the §164.530(j) windows apply to PHI-handling documentation.

Federal contractors — Davis-Bacon and Service Contract Act

29 CFR §5.5(a)(3)(i)(A) — Davis-Bacon Act — requires that "all regular payrolls and other basic records must be maintained by the contractor and any subcontractor during the course of the work and preserved for all laborers and mechanics working at the site of the work (or otherwise working in construction or development of the project under a development statute) for a period of at least 3 years after all the work on the prime contract is completed."

The clock starts at prime-contract completion, not record creation. A three-year project produces de facto six-year retention; a five-year project produces eight-year retention.

29 CFR §4.6(g)(1) — Service Contract Act — imposes a parallel three-year-after-completion retention for federally-funded service contractors.

Public sector — state record-retention schedules

State and federal public-sector record-retention schedules typically run five to seven years, set by state archive statutes rather than the labor code. Each state's Secretary of State or State Archivist publishes a retention schedule. Public employers consult the General Records Retention Schedule for their state rather than the labor code alone.

Federal layered retention — the maximum-window rule

The FLSA / §516 framework sets the floor. Several federal statutes layer additional, longer, or differently-scoped retention duties on top. Employers must keep the maximum applicable window for each category of record.

Statute / Regulation	Records	Retention
FLSA §211(c) + 29 CFR §516.5	Payroll records (§516.2(a) list)	3 years
FLSA §211(c) + 29 CFR §516.6	Time cards, schedules, wage-rate tables	2 years
IRC §6001 / Treas. Reg. §31.6001-1	FICA, FUTA, withholding records	4 years
IRC §6051	W-2 employer copies	4 years
ERISA §107 (29 USC §1027)	Benefit plan records	6 years
ACA §4980H reporting (post-ERIA 2024)	1094-C / 1095-C source records	6-year SOL post-ERIA
Davis-Bacon (29 CFR §5.5(a)(3))	Federally-funded construction payroll	3 years post-completion
SCA (29 CFR §4.6(g)(1))	Federally-funded service contracts	3 years post-completion
OSHA (29 CFR §1904.33)	Form 300 / 300A / 301 logs	5 years post-calendar-year
EEOC (29 CFR §1602.14)	Personnel records	1 year (extends during charge)
FMLA (29 CFR §825.500)	FMLA records	3 years

The practical answer for most employers: keep everything for the longest applicable window — six years if ERISA-covered, four years otherwise. The savings from honoring the floor (two years for time cards) almost always lose to the cost of one Mt. Clemens-shaped defense gone wrong.

ERISA §107 — 29 USC §1027

"Every person subject to a requirement to file any report under this title ... shall maintain records on the matters of which disclosure is required which will provide in sufficient detail the necessary basic information and data from which the documents thus required may be verified, explained, or clarified, and checked for accuracy and completeness, and shall include vouchers, worksheets, receipts, and applicable resolutions, and shall keep such records available for examination for a period of not less than six years after the filing date of the documents based on the information which they contain ..."

Benefit-plan records — 401(k), health plan, COBRA notices, ERISA-governed welfare plans — must be kept six years from the filing date of the document the records support.

ACA reporting — Employer Reporting Improvement Act of 2024

The IRS regulations historically prescribed a four-year retention for 1094-C and 1095-C source records under the §31.6001-1 employment-tax framework. The Employer Reporting Improvement Act, signed December 23, 2024, codified a six-year statute of limitations for §4980H Employer Shared Responsibility assessments imposed after December 31, 2024 — running from the later of the form's due date or actual filing date. Before ERIA, the IRS Office of Chief Counsel had taken the position that §4980H had no statute of limitations at all. Practitioner standard post-ERIA: retain ALE reporting records for at least six years.

OSHA injury and illness records — 29 CFR §1904.33

"The employer must save the OSHA 300 Log, the privacy case list (if one exists), the annual summary, and the OSHA 301 Incident Report forms for five (5) years following the end of the calendar year that these records cover."

The 300 Log must be updated during those five years to reflect newly-discovered recordable injuries or case-classification changes.

EEOC personnel records — 29 CFR §1602.14

"Any personnel or employment record made or kept by an employer ... shall be preserved by the employer for a period of one year from the date of the making of the record or the personnel action involved, whichever occurs later. ... Where a charge of discrimination has been filed, or an action brought by the Commission or the Attorney General, against an employer under title VII, the ADA, or GINA, the respondent employer shall preserve all personnel records relevant to the charge or action until final disposition of the charge or the action."

One year ordinarily; indefinite during a pending charge or action.

FMLA — 29 CFR §825.500

"Employers must keep the records specified by these regulations for no less than three years and make them available for inspection, copying, and transcription by representatives of the Department of Labor upon request."

FMLA-related records — leave dates, employee notices, dispute documentation — must be kept three years.

Multi-state and remote workers

The governing principle is work-location, not employer-headquarters or employee-residence. An employee performing work in New York is entitled to New York's six-year recordkeeping window even if the employer is headquartered in Texas. The rule traces to the state-by-state labor codes — each state's recordkeeping statute applies to employees performing work in that state.

Scenarios:

A remote engineer based in Austin who works occasional weeks from a New York vacation home triggers NYLL §195(4)'s six-year window for the New York work period. The Texas employer must maintain six-year records for the New York hours alongside the four-year TWC standard for the Texas hours.
A multi-state field-service technician working in California three days, Colorado one day, and Texas one day of a workweek triggers California's §1174 three-year (four-year UCL) window for the California hours, Colorado's §8-4-103(4.5) three-year-plus-$250/emp/mo window for the Colorado hours, and the TWC four-year UI standard for the Texas hours. The records system must capture per-day work location to satisfy each state's reach-back.
A salaried non-exempt worker in Hawaii who attends a project meeting in California triggers Hawaii's six-year window for the Hawaii hours and California's three-year (four-year UCL) window for the California hours. The federal §516 three-year window applies as the floor in both states.

The compliance implication: work-location tracking is the load-bearing recordkeeping primitive for any multi-state or remote workforce. Time records that capture only hours-per-week without per-day work location cannot satisfy §516.2 plus the state-law overlays.

Recent changes (last 18 months)

Washington SHB 1308 (effective July 27, 2025) — Substitute House Bill 1308 (signed May 13, 2025) amended RCW 49.12.240 and 49.12.250. The new law extends personnel-file access to former employees within three years of separation, defines "personnel file" to include payroll records and employment agreements, requires production within 21 calendar days, and imposes graduated statutory damages: $250 (delay past 21 days), $500 (past 28 days), $1,000 (past 35 days), plus a $500 catch-all penalty for any other violation of RCW 49.12.250(1). The new layer sits on top of WAC 296-126-050's three-year retention.
Employer Reporting Improvement Act (signed December 23, 2024) — codified a six-year statute of limitations for §4980H assessments imposed after December 31, 2024. ALE reporting records (1094-C / 1095-C) now warrant six-year retention rather than the prior four-year practitioner standard.
Colorado HB 22-1118 stable through 2025–2026 — C.R.S. §8-4-103(4.5) continues to require three-year retention with the $250-per-employee-per-month penalty (up to $7,500 cap) per CDLE INFO #3A guidance. No further amendments in the 2024–2025 sessions.
Federal §516 framework stable — DOL WHD continues to enforce 29 CFR Part 516 as routine in every Tier-1 wage-hour investigation. No major amendments to the three-year payroll / two-year supporting-record windows have been promulgated.
NY recordkeeping retention stable — NYLL §195(4) and §661 maintain the six-year window through May 2026. NY S5572 (signed September 15, 2023, effective March 13, 2024) raised the executive/administrative/professional minimum-wage threshold from $900 to $1,300/week but does not affect recordkeeping retention.

FAQ

How long must employers keep payroll records under federal law?

Three years for the payroll records listed in 29 CFR §516.2(a) — names, addresses, hours worked each workday and workweek, regular hourly rate, straight-time and premium earnings, total wages paid, and pay-period dates. Two years for the underlying time cards, work schedules, and wage-rate tables under 29 CFR §516.6. The two-year window on time cards is the trap — practitioner standard is three years across both categories to match the 29 USC §255(a) willful-violation statute of limitations.

What records must I keep for an exempt employee?

29 CFR §516.3 requires the §516.2(a) items EXCEPT (a)(6)–(a)(10) — the hour-by-hour and regular-rate items are dropped for properly exempt §13(a)(1) employees. The employer must additionally record the basis on which wages are paid in sufficient detail to permit calculation of total remuneration including fringe benefits. If the exemption fails (the misclassification scenario), the lack of time records creates Mt. Clemens exposure.

Does the FLSA require pay stubs?

No. 29 USC §211(c) and 29 CFR Part 516 require employers to maintain records. They do not require delivery of an itemized statement to the employee. Every meaningful pay-stub right in the United States — California Labor Code §226(a), New York Labor Law §195(3), and the other state statutes — comes from state law.

What happens if I cannot produce records when the DOL asks?

29 CFR §516.7 requires records at a central recordkeeping office to be produced within 72 hours of DOL notice. Failure to produce within that window is a §211(c) violation independent of any underlying wage-hour issue. The bigger downstream consequence is Mt. Clemens — Anderson v. Mt. Clemens Pottery Co., 328 U.S. 680 (1946), holds that when employer records are inadequate, the employee's reasonable inference of hours worked becomes the operative record. Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016), extended the doctrine to representative evidence at class certification, with a $2.9 million jury verdict doubled to roughly $5.8 million in final FLSA recovery.

Which state requires the longest retention?

New York, New Jersey, and Hawaii are tied at six years. NY Lab. Law §195(4) and §661 require contemporaneous, true, and accurate payroll records preserved six years. New Jersey's wage-and-hour recordkeeping notice requires six years for wage-and-hour records. HRS §387-6 plus the Hawaii DLIR Wage Standards Division rule applies the same six-year period. New York's six-year window matches the NYLL §198(3) six-year statute of limitations exactly.

When does a litigation hold attach?

When the employer knows or reasonably should know that litigation is probable — not when the complaint is filed. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y. 2003), established the framework. Fed. R. Civ. P. 37(e) (2015 amendment) distinguishes negligent loss (lesser sanctions, including curative measures) from intentional deprivation (adverse-inference instructions, case-dispositive sanctions). A demand letter, DOL audit notice, or EEOC charge triggers the hold. Routine three-year-rotation deletion that destroys responsive records after the trigger is sanctionable spoliation.

How long should I retain benefit-plan records?

Six years from the filing date of the document the records support, under ERISA §107 (29 USC §1027). The six-year window covers 401(k), health plan, COBRA notices, and ERISA-governed welfare plans. ACA reporting records (1094-C / 1095-C) also warrant six-year retention after the Employer Reporting Improvement Act of 2024 codified a six-year statute of limitations for §4980H Employer Shared Responsibility assessments imposed after December 31, 2024.

Are electronic records sufficient?

Yes. 29 CFR §516.7 explicitly contemplates centrally-stored records. The operative constraint is the 72-hour-on-demand production window. Cloud-hosted records satisfy §516.7 if the employer can retrieve and produce within that window. They do not satisfy it if the employer has lost vendor credentials, let a subscription lapse, or otherwise cannot produce on demand. The export-on-termination clause with the SaaS vendor and the quarterly audit-readiness test of the retrieval pipeline are the operational disciplines this rule rewards.

If you discover you've been doing this wrong

Reconstruct the records. Pull payroll data, schedule data, time-clock records, and any auxiliary timekeeping (project management, ticketing systems, badge swipes, security camera review). 29 CFR §516.2 requires the records; the absence of them shifts the burden under Anderson v. Mt. Clemens Pottery Co., 328 U.S. 680 (1946). Sworn employee declarations of typical hours, combined with auxiliary system data, may rebuild a defensible record.
Identify the affected period. Federal statute of limitations under 29 USC §255(a) is two years for non-willful violations, three for willful. California Bus. & Prof. Code §17208 reaches four years through the UCL. NY Lab. Law §198(3) reaches six years. Massachusetts mandates treble damages within the three-year window under MGL c.151 §1B. The longest applicable window controls the reach-back.
Audit the SaaS retrieval pipeline. Confirm that the time-and-attendance vendor can export the full record set for the relevant period in a form usable by a DOL investigator within 72 hours. Test the export end-to-end, not just the admin login. Document the export-on-termination clause with the vendor in writing. If the subscription has lapsed, restore access before any further deletion.
Implement the litigation hold if triggered. A demand letter, DOL audit notice, or EEOC charge attaches the duty to preserve under Zubulake and Fed. R. Civ. P. 37(e). Suspend automatic deletion across all relevant systems — time-and-attendance, payroll, email, project management, badge logs. Document the suspension with a written hold notice to record custodians.
Consult counsel before voluntary payment exceeding the practical class-action threshold. Voluntary payment under DOL supervision (PAID program or WHD-supervised settlement) can resolve the federal claim with a release; voluntary payment without DOL supervision does not waive employee rights to liquidated damages or attorneys' fees under 29 USC §216. California requires Labor Commissioner or court approval for valid wage releases. Per-worker exposure above the $5,000–$10,000 mark warrants class-mechanics counsel before any payment.

The bottom line

The federal recordkeeping equation has three numbers: three years for payroll records under 29 CFR §516.5, two years for the underlying time cards under §516.6, and 72 hours to produce them under §516.7. Anderson v. Mt. Clemens Pottery Co., 328 U.S. 680 (1946), and its class-certification extension in Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016), make the records load-bearing — the employer who lacks them lacks the defense.

The structural failure modes recur: keeping only the rounded total and losing the punch-by-punch source-of-truth; migrating to a SaaS vendor without testing 72-hour retrieval; missing California's 21-day inspection window; treating a misclassified exempt as needing no records; routine deletion that destroys responsive records after a litigation hold has attached. Each compounds across the statute of limitations and doubles under liquidated damages.

The highest-leverage operational discipline is the recordkeeping primitive itself. Time records that capture every punch, every edit, and every approval — anchored to workweek and work-location — satisfy §516.2, survive the §516.7 production window, and produce the audit trail that defeats Mt. Clemens. Everything downstream — overtime computation, regular-rate audit, pay-stub itemization, meal-break presumption rebuttal — is built on that record.

Sources

Federal statutes

29 USC §211(c) — Recordkeeping mandate: https://www.law.cornell.edu/uscode/text/29/211
29 USC §216 — Penalties and damages: https://www.law.cornell.edu/uscode/text/29/216
29 USC §255 — Statute of limitations: https://www.law.cornell.edu/uscode/text/29/255
29 USC §1027 — ERISA §107 records: https://www.law.cornell.edu/uscode/text/29/1027
26 USC §6051 — W-2 employer copies: https://www.law.cornell.edu/uscode/text/26/6051

Federal regulations

29 CFR §516.2 — Required records, non-exempt employees: https://www.law.cornell.edu/cfr/text/29/516.2
29 CFR §516.3 — Required records, exempt employees: https://www.law.cornell.edu/cfr/text/29/516.3
29 CFR §516.5 — Three-year retention: https://www.law.cornell.edu/cfr/text/29/516.5
29 CFR §516.6 — Two-year retention: https://www.law.cornell.edu/cfr/text/29/516.6
29 CFR §516.7 — Place of records / 72-hour production: https://www.law.cornell.edu/cfr/text/29/516.7
26 CFR §31.6001-1 — Employment-tax records: https://www.law.cornell.edu/cfr/text/26/31.6001-1
29 CFR §5.5 — Davis-Bacon contract clauses: https://www.law.cornell.edu/cfr/text/29/5.5
29 CFR §1904.33 — OSHA injury and illness records: https://www.law.cornell.edu/cfr/text/29/1904.33
29 CFR §1602.14 — EEOC personnel records: https://www.law.cornell.edu/cfr/text/29/1602.14
29 CFR §825.500 — FMLA recordkeeping: https://www.law.cornell.edu/cfr/text/29/825.500
49 CFR §395.8 — Trucking HOS records: https://www.law.cornell.edu/cfr/text/49/395.8
45 CFR §164.530 — HIPAA documentation retention: https://www.law.cornell.edu/cfr/text/45/164.530
Fed. R. Civ. P. 37 — Failure to make disclosures: https://www.law.cornell.edu/rules/frcp/rule_37

Recordkeeping Requirements: How Long to Keep Time and Payroll Records by State

Quick reference

The 5 most expensive recordkeeping mistakes

The federal floor

29 USC §211(c) — the recordkeeping mandate

29 CFR §516.2(a) — the twelve required items

29 CFR §516.3 — exempt employees

29 CFR §516.5 — three-year retention

29 CFR §516.6 — two-year retention

29 CFR §516.7 — place of records and 72-hour production

DOL Fact Sheet #21

29 USC §255(a) — statute of limitations

Anderson v. Mt. Clemens Pottery Co. — the doctrinal hinge

California — three years statute, four years practice, $750 inspection penalty

Things employers consistently miss

State-by-state table

The six-year states — New York, New Jersey, and Hawaii

New York — NY Labor Law §195(4) and §661

New Jersey — Wage Payment Law and Wage and Hour Law notice

Hawaii — HRS §387-6 plus DLIR rule

Industry-specific rules

Trucking — 49 CFR §395.8(k): six-month HOS records

Healthcare — HIPAA's six years is not the FLSA window

Federal contractors — Davis-Bacon and Service Contract Act

Public sector — state record-retention schedules

Federal layered retention — the maximum-window rule

ERISA §107 — 29 USC §1027

ACA reporting — Employer Reporting Improvement Act of 2024

OSHA injury and illness records — 29 CFR §1904.33

EEOC personnel records — 29 CFR §1602.14

FMLA — 29 CFR §825.500

Multi-state and remote workers

Recent changes (last 18 months)

FAQ

How long must employers keep payroll records under federal law?

What records must I keep for an exempt employee?

Does the FLSA require pay stubs?

What happens if I cannot produce records when the DOL asks?

Which state requires the longest retention?

When does a litigation hold attach?

How long should I retain benefit-plan records?

Are electronic records sufficient?

If you discover you've been doing this wrong

The bottom line

Sources

Federal statutes

Federal regulations

DOL guidance

State statutes

Case law

Related

Recordkeeping Requirements: How Long to Keep Time and Payroll Records by State

How Long to Keep Payroll Records

Free Timesheet Templates

About Clockspot