Federal law requires you to keep timecards for at least two years and payroll records for at least three. California requires payroll and time records for at least three years. Most employers should plan to keep them longer than that. This guide explains each rule, where the minimums stop being enough, and how to store digital timecards so you can produce them quickly.
TL;DR
- Federal (FLSA): keep timecards and other wage-computation records for 2 years, and payroll records for 3 years.
- IRS: keep employment tax records for at least 4 years.
- California: keep payroll and time records for at least 3 years, with a longer period for some industries such as garment manufacturing.
- Practical rule: the strictest rule that applies to you wins, and many employers keep time data 3 to 4 years or more. Delete on a schedule once that period ends.
- Paperless is fine: the law sets no required format, but the records must be complete, accurate and producible on demand.
Table of Contents
- The federal rule: two years for timecards, three for payroll
- IRS rules: four years for employment tax records
- California: at least three years, and the burden is on you
- Other states may require more
- Why the minimum is rarely enough
- Keep what you need, delete what you do not
- What a compliant digital timecard should contain
- Software helps, but you remain responsible
- Our perspective: retention starts at the punch
- A simple retention schedule to adapt
- How to put this in practice
- Keep records without the paperwork
- FAQ
- Sources
The federal rule: two years for timecards, three for payroll
The Fair Labor Standards Act (FLSA) is the baseline for most US employers. The Department of Labor's Fact Sheet #21 splits records into two groups:
| Record type | Minimum retention | Examples |
|---|---|---|
| Payroll records | 3 years | Payroll registers, collective bargaining agreements, sales and purchase records |
| Records behind wage computations | 2 years | Time cards, piece work tickets, wage rate tables, work and time schedules, records of additions to or deductions from wages |
The same fact sheet says the Act requires no particular form for these records. A paper card, a spreadsheet and a GPS time-tracking app are all acceptable, as long as the required information is there. The Department of Labor's Handy Reference Guide to the FLSA says the same, and it covers the basics of what to record.
Two details matter in practice:
- Records cover work wherever it happens. The Department of Labor's recordkeeping page says employers must keep records of all wages paid and hours worked, regardless of where the work is performed. That includes job sites, client homes and vehicles.
- The clock starts with the record, not the employee. Plan retention around the pay period or date of the record, not around when someone leaves. Keeping a departed worker's last two years of timecards is still required.
IRS rules: four years for employment tax records
Timecards often back up payroll tax figures, so tax rules matter too. The IRS employment tax recordkeeping page says to keep all employment tax records for at least four years after filing the fourth quarter for the year. They should be available for IRS review.
The IRS also explains in its how long to keep records guidance that the general limitation period for a return is 3 years. It extends in certain cases, such as substantial underreporting of income.
If timecards are the source for wages you report, a four-year retention window for the hours behind those wages is a sensible reading. It is longer than the FLSA's two years for timecards, so the longer period governs.
California: at least three years, and the burden is on you
If you employ people in California, the state rules are stricter than the federal baseline. Labor Code section 1174 requires employers to keep payroll records, including records of hours worked, and to make them available to the Division of Labor Standards Enforcement. The standard period is three years. Some industries have longer rules. For example, Title 8, section 13631 applies to garment manufacturing, and the research we reviewed puts that at four years.
The state also tells workers what to expect. The Labor Commissioner's Office says on its DLSE page that your employer must keep accurate time and payroll records, and that you are not required to keep your own. In a wage dispute, an employer who cannot show adequate records is in a weak position, because the burden often shifts to the employer.
Then there is speed. Labor Code section 1174.1 can bar an employer from introducing records as evidence in certain proceedings if the employer failed to produce them when required. Retention is only half the job. You also need to find and export the right records quickly.
For a fuller California picture, see our guides on audit-ready timekeeping for California employers and California wage and hour compliance.
Other states may require more
The federal rule is a floor. States can set longer periods, and many do. Wisconsin, for instance, requires employers to keep records for at least three years in its published guidance, though you should confirm the current text on that state's site. If you operate in several states, do not memorize each one. Set your policy to the longest period that applies to any state where you have employees, then review it once a year.
Why the minimum is rarely enough
Most employers do not stop at the minimum, and for good reason. Wage and hour claims can reach back further than the basic retention rules suggest. If a claim is filed and your records have been deleted, you may have nothing to answer it with.
A workable approach for many US employers:
- Find the longest rule that applies. Compare FLSA (2 and 3 years), IRS (4 years) and any state rule.
- Add a margin. Many businesses keep time and payroll records 4 to 7 years to line up with the limitation periods for possible claims. Ask your employment attorney which period fits your state and industry.
- Pause deletion when a claim exists. If there is an audit, a charge or a lawsuit, keep all related records until it is fully resolved.
- Delete on schedule afterward. Once the period ends and no claim is open, remove the records.
That last step is easy to skip. Keeping data forever carries its own risk, which the next section covers.
Keep what you need, delete what you do not
Timecards that include GPS data are personal data about where a person was and when. Privacy frameworks, including the EU's GDPR, expect employers to limit how long they keep it. The Article 29 Working Party's opinion on data processing at work stresses balancing record-keeping needs against data minimization. It also warns against reusing monitoring data for unrelated purposes.
The US has no single federal rule like GDPR for this, and California has its own privacy laws. Even so, the principle is practical for any employer. Decide why you keep each type of data, and for how long.
A simple split works well:
- Keep for the full retention period: punch times, hours worked, approvals, edits and their reasons, pay rates, and the timesheet attestation.
- Keep for a shorter, defined time: detailed location points that were only used to verify a punch.
- Do not collect: continuous background location for people who are off the clock.
Check with counsel before shortening the life of any record that could matter in a wage claim.
What a compliant digital timecard should contain
The federal fact sheet lists the information employers must keep for each non-exempt worker. It includes name, address, occupation, hours worked each day and week, wages, and the pay period covered. A good digital record does more than hold punch times.
- Original punches and edits. Keep the first entry and every change, with who made it and when.
- Approval trail. Record who reviewed and approved each timesheet.
- Employee attestation. A signed-off statement that hours are correct is useful if a worker later disputes them. See our guide to timesheet attestation in seven steps.
- Exceptions and fixes. Missed punches, late arrivals and corrections should be documented, as in our attendance exception workflow.
- Travel and off-site time. For California field teams especially, see how documenting travel time reduces audit risk.
Software helps, but you remain responsible
There is no required format for timecards, and automation does not move the responsibility. The law asks that the records be complete and accurate. If a system records wrong hours, the employer still owns the problem. Review the exports, check the exceptions, and confirm that edits are logged. Our guide on making electronic timekeeping audit-ready walks through this.
That is also why the choice of time clock matters. Verification at the moment of the punch prevents inaccurate records at the source. If you are weighing options, a guide to biometric time clocks for owners and managers covers how identity checks fit into recordkeeping.
Our perspective: retention starts at the punch
We build Clock-me for teams that work in the field, and we see the same pattern in retention questions. Employers ask how long to store records. The better question is whether the record was trustworthy when it was created.
A timecard that says someone was at a site for eight hours has little value if a coworker clocked in for them. It has little value, too, if it was typed in from memory a week later. Storing it for seven years does not fix that. So we focus on the front end: GPS-verified punches, identity checks, geofencing, random location check-ins and device-based fraud detection. We do not use continuous background tracking.
On the back end, we think retention should be boring. Timesheets are approved, employees attest to them, and payroll export produces a clean file. When a request comes in, whether from an auditor, a labor agency or your own payroll team, you should be able to produce records in minutes rather than days. If a request deadline is short, as under California's evidence rules, that speed protects you.
We also encourage employers to write down their retention schedule and follow it, including deletion. Paper timesheets in a filing cabinet were never searchable. Digital ones can be, and that is an advantage only if you treat it like one.
— Clock-me
A simple retention schedule to adapt
Use this as a starting template and adjust with your attorney and accountant. It is not legal advice.
| Record | Federal minimum | Suggested practice |
|---|---|---|
| Timecards, punch logs, schedules | 2 years (FLSA) | Longest applicable state period, often 3 years or more |
| Payroll registers | 3 years (FLSA) | At least 4 years to cover IRS employment tax rules |
| Employment tax records | 4 years (IRS) | 4 years after filing the fourth quarter |
| California payroll and time records | 3 years (Labor Code 1174) | 3 years minimum, longer if counsel advises |
| Raw GPS location points | No federal minimum | Shorter, defined period tied to verification |
| Records tied to an open claim or audit | Until resolved | Hold everything, suspend deletion |
How to put this in practice
- Inventory where time data lives. Apps, spreadsheets, paper sheets and payroll exports all count.
- Set one policy. Pick the longest period that applies and write it down.
- Lock the record. Approved timesheets should be read-only, with changes logged.
- Test an export. Pull a full month for one employee and see how long it takes. Our approval workflow guide helps clean up the process before records are locked.
- Schedule deletion. Put a yearly reminder in the calendar to purge records past the period with no open claims.
Keep records without the paperwork
Clock-me gives field teams one-tap clock-ins verified by GPS, with geofencing, identity checks, live dashboards, timesheet approval and payroll export. There is a Free plan at $0 per month for small teams, and paid plans start with Starter at $31.99 per month. Growth is $54.99, Business $99.99, Pro $224.99 and Corporate $439.99 per month, all based on active employees. Enterprise pricing is not published. You can compare them on our plans page, or see how GPS punch clocks work.
FAQ
How long should a company keep timesheets?
Federally, timecards must be kept for at least two years and payroll records for three. California requires at least three years for payroll and time records. Because the IRS wants employment tax records for four years, many employers keep timesheets for at least that long.
Do I need to keep paper timecards if I use an app?
No. The Department of Labor says the FLSA requires no particular form for records. What matters is that digital records are complete, accurate and can be produced when an agency asks for them. Keep the original punches and an edit history.
What records need to be kept for 7 years?
No general federal rule requires seven years for timecards. Some employers adopt a seven-year schedule as a cautious practice for payroll and tax-related documents, and the IRS can look back further in cases of substantial underreporting. Ask your attorney or accountant what fits your state and situation.
What happens if I cannot produce timecards?
In a wage dispute, missing records weaken your position, and in California the burden can shift to the employer. Labor Code 1174.1 can also prevent an employer from using records as evidence if they were not produced when required. Fast, organized exports are the best protection.
Can I delete GPS location data after payroll is done?
Often yes for detailed location points, but keep the punch time, hours and approvals for the full retention period. Raw location data should have a shorter, defined life tied to why you collected it. Confirm with counsel before deleting anything that could be relevant to a claim.
Sources
- Fact Sheet #21: Recordkeeping Requirements under the FLSA
- Handy Reference Guide to the FLSA
- Recordkeeping, U.S. Department of Labor
- Employment tax recordkeeping, IRS
- How long should I keep records, IRS
- California Labor Code section 1174
- California Labor Code section 1174.1
- California Code of Regulations, Title 8, section 13631
- Division of Labor Standards Enforcement
- Article 29 Working Party opinion on data processing at work