FCRA Recordkeeping: How Long You Must Keep the Paperwork (2026)

The FCRA itself does not set a retention period for background-check records. The retention rules come from the statutes that govern related employment claims — Title VII, the ADA, ADEA, OSHA, the FLSA, and the state analogues — and from the records the EEOC asks for when it investigates.

The federal floor

• Title VII / ADA / ADEA: 1 year from the date of the personnel action (EEOC §1602.14). Extended to 2 years for federal contractors covered by EO 11246.
• OSHA Form 300 / 301: 5 years after the calendar year the record covers.
• FLSA payroll-adjacent records: 3 years.
• Form I-9: 3 years after hire, or 1 year after termination, whichever is later.

The state overlays

• California: 4 years for personnel records (Labor Code §1198.5), 4 years for FEHA-relevant records.
• New York: 6 years for records relevant to the NYC Human Rights Law.
• Illinois: 5 years for IHRA-relevant records.
• Washington: 3 years post-employment for personnel records.

The SafestHires recommended retention schedule

1. FCRA disclosure + authorization: 7 years from the date of the report.
2. Background-check report: 7 years from the date of the report.
3. Pre-adverse action packet: 7 years from the date sent.
4. Final adverse action notice: 7 years from the date sent.
5. Individualized assessment / rational-relationship analysis: 7 years from the date sent.

Seven years exceeds every state retention rule and aligns with the statute of limitations on the most common FCRA class-action theories. It is the single number you can adopt as policy without per-state engineering.

Where the records live matters

Retention is not just duration — it is retrievability. The records have to be producible on a litigation hold within the response window the court sets, typically 30 days. SafestHires holds the entire hiring file in tamper-evident storage with audit logging on every read, so a single-button export produces the package a plaintiff's firm subpoenas.