Legal Sources & Citations

Every retention recommendation is grounded in a verifiable source. Click through to the official text.

Federal Statutes & Regulations (US)

HIPAA Privacy Rule

45 C.F.R. § 164.530(j)(2)

Healthcare records — 6 years from creation or last effect.

Fair Labor Standards Act — Recordkeeping

29 C.F.R. § 516.5

Payroll records — 3 years; supporting records — 2 years.

OSHA Recordkeeping

29 C.F.R. § 1904.33

Injury and illness logs — 5 years.

IRS Recordkeeping

26 U.S.C. § 6501

Tax returns and supporting documents.

FRCP Spoliation

Fed. R. Civ. P. 37(e)

Litigation hold and ESI preservation.

GDPR — Storage Limitation

GDPR Art. 5(1)(e)

Personal data limited to necessary period.

GDPR — Conditions for Consent

GDPR Art. 7(1)

Demonstrate valid consent.

TCPA

47 U.S.C. § 227

Telemarketing & SMS consent records.

California — Statute of Limitations (Written Contract)

Cal. Civ. Proc. § 337

4-year limitations period for written contracts.

Record Type	Authority	Citation
Patient Medical Records	HIPAA Privacy Rule	45 C.F.R. § 164.530(j)(2)
Employee Payroll Records	Fair Labor Standards Act	29 C.F.R. § 516.5
Tax Returns & Supporting Documents	IRS Recordkeeping Requirements	26 U.S.C. § 6501; IRS Pub. 583
Personally Identifiable Information (PII)	GDPR Storage Limitation	GDPR Art. 5(1)(e)
Contracts & Agreements	State Statute of Limitations (Contract)	Cal. Civ. Proc. § 337
Email Correspondence	Internal Policy / Litigation Hold	Fed. R. Civ. P. 37(e)
Workplace Injury Records (OSHA)	OSHA Recordkeeping Standard	29 C.F.R. § 1904.33
Marketing Consent Records	TCPA / GDPR Consent Documentation	47 U.S.C. § 227; GDPR Art. 7(1)