Colorado records retention requirements start with a three-year default: if a state or local law requires you to keep a record but doesn’t say for how long, three years from the date of creation is the floor. From there, the actual timeline depends on what kind of record it is and which regulator cares about it. Tax records, payroll files, medical charts, bank records, and real estate transaction files all carry their own schedules, and federal rules often sit on top of state ones. The ranges run from one year for basic personnel files to ten years or longer for healthcare records involving minors.
The Three-Year Default Under CRS 6-17-104
CRS 6-17-104 is the catch-all. When a Colorado statute or local ordinance requires you to create or keep a record but is silent on the retention period or destruction procedure, you must keep it for three years from the date it was created. After three years, you can destroy it legally.1Colorado Public Law. Colorado Revised Statutes 6-17-104 – Records Retention Period
This default only governs where nothing else does. Many record categories have their own specific retention rules, and those always control. Treat three years as the floor for records that don’t fall under a more specific regime.
Retention Periods by Record Type
The timelines below pull from the Colorado and federal rules that most often apply to businesses and public agencies operating in the state.
Federal Tax Records
IRS rules apply to every Colorado business regardless of state law. The baseline is three years from the filing date for a standard return, but several situations extend that period.2Internal Revenue Service. How Long Should I Keep Records?
- Standard returns: three years from filing.
- Returns where income was underreported by more than 25% of gross income: six years.
- Claims for bad debt deductions or worthless securities: seven years.
- Employment tax records: at least four years after the tax becomes due or is paid, whichever is later.
- Unfiled returns or fraudulent returns: no statute of limitations, so keep records indefinitely.
For business property, keep records supporting cost basis, depreciation, and improvements for as long as you own the asset plus at least three years after you report its sale or disposition. Seven years after disposition gives a comfortable margin against the longer audit windows.3Internal Revenue Service. Topic No. 305, Recordkeeping
Employment and Workplace Records
Federal equal employment rules require personnel and employment records to be kept for at least one year. If an employee is involuntarily terminated, their records must be kept one year from the termination date. When an EEOC charge is pending, records tied to the investigation must be kept until the charge reaches final disposition, including any resulting lawsuit.4U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
Payroll runs longer. The Fair Labor Standards Act requires employers to preserve payroll records, collective bargaining agreements, and sales and purchase records for at least three years.5U.S. Department of Labor. Fact Sheet #21: Recordkeeping Requirements Under the Fair Labor Standards Act (FLSA)
Workplace safety records have their own schedule. OSHA 300 Logs, annual summaries, and 301 Incident Report forms must be kept for five years following the end of the calendar year they cover, and stored logs must be updated during that five-year period to reflect newly discovered injuries or reclassifications.6Occupational Safety and Health Administration. Retention and Updating
Healthcare Records
Colorado Department of Public Health and Environment regulations require healthcare facilities to preserve medical records for at least ten years after the most recent patient care usage. For minors, records must be kept for the period of minority plus ten years, so a record for a five-year-old patient must be retained until the patient turns 28.7Legal Information Institute. 6 CCR 1011-1-20-7 – Health Information Management Records can be kept in original form or on a technologically appropriate medium as determined by the department.
Dental providers operate under a separate rule, 3 CCR 709-1, with a seven-year retention period for adult patient records. The split occasionally causes confusion when providers assume the ten-year facility rule covers them.
Financial Institutions
Banks and credit unions operating in Colorado follow the federal Bank Secrecy Act, which generally requires financial institutions to retain most covered records for at least five years. That includes records of credit extensions over $10,000 not secured by real property, and records of international transactions above the same threshold.8FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements
Real Estate Transaction Files
Colorado real estate brokers and brokerage firms must retain transaction files for four years. The clock starts at the closing date of the transaction or the expiration date of any listing contract that didn’t close. Files can be kept in hard copy or electronic format as long as they can be produced for inspection during the four-year window.9Division of Real Estate. Transaction File Requirements and Retention The Commission’s Transaction File Checklist designates what must be in sales files and property management files.10Colorado Division of Real Estate. Transaction File Checklist
Government Records
State and local government agencies follow retention and disposition schedules developed by the Colorado State Archives. These schedules identify which records have permanent historical value and set timetables for everything else.11Colorado State Archives. State Agency Records Management Schedule 40 covers general municipal records including charters, meeting minutes, and supporting documentation.12Colorado State Archives. Colorado Municipal Records Retention Schedule Schedule No. 7 details minimum retention periods for accounting documents, budget files, and related financial records across state agencies.13Colorado State Archives. Colorado Records Management Manual Schedule No. 7 Financial Records For records not covered by an Archivist schedule, each agency develops its own.
Electronic Records and Secure Disposal
Colorado’s Uniform Electronic Transactions Act gives electronic records the same legal standing as paper. Under CRS 24-71.3-112, an electronic record satisfies any legal requirement to retain a record as long as it accurately reflects the original and remains accessible for later reference. That standard also applies when a law requires a record to be kept in original form, and it covers checks, evidentiary records, and audit documentation.14Justia. Colorado Code Title 24 Article 71.3 – Uniform Electronic Transactions Act
The statute doesn’t prescribe specific technical measures. The test is functional: can you produce the record, and does it accurately reflect the original? Government agencies can impose additional technical requirements on records under their jurisdiction, so regulated industries should check with their oversight body.
Disposal has its own rule. Under CRS 6-1-713, any business or government entity that maintains documents containing personal identifying information must develop a written destruction policy, and the destruction must render the personal information unreadable, whether by shredding paper, erasing digital files, or otherwise making the data indecipherable.15Justia. Colorado Code 6-1-713 – Disposal of Personal Identifying Information – Policy – Definitions This applies to both paper and electronic records. The Colorado Privacy Act, in effect since 2023, layers on additional obligations for businesses that process personal data of Colorado consumers.
Litigation Holds Override Every Schedule
Normal retention schedules stop applying the moment your organization reasonably anticipates litigation. You must suspend routine destruction and implement a litigation hold to preserve records that could be relevant to the dispute. The duty attaches when a party knows or should have known that evidence is relevant to future or current litigation, and the trigger doesn’t have to be a filed lawsuit. A threatening letter, an internal harassment report, or a regulatory investigation can all create the obligation.
A litigation hold means directing everyone in the organization who might have relevant documents to stop deleting files, emails, and messages across every storage system. Failing to preserve after the duty attaches can produce court sanctions, adverse inference instructions telling the jury to assume the destroyed evidence would have hurt you, or case-dispositive rulings.
What Non-Compliance Costs
Penalties scale with the regime. Consumer protection violations under the Colorado Consumer Protection Act framework can reach $20,000 per violation, with each affected consumer or transaction treated as a separate violation. Violations involving elderly consumers carry a maximum of $50,000 per violation.16Justia. Colorado Code 6-1-112 – Civil Penalties A disposal failure affecting hundreds of individuals compounds fast.
Bank Secrecy Act penalties run on a tiered structure. Negligent violations draw a $500 civil penalty per incident, and a pattern of negligent violations raises that to $50,000. Willful violations carry a civil penalty of the greater of $25,000 or the transaction amount, up to $100,000.17Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Criminal exposure goes further: willful violations can produce fines up to $250,000 and imprisonment for up to five years, with those maximums rising to $500,000 and ten years when the violation is part of a broader pattern of illegal activity involving more than $100,000 in a 12-month period.18Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
Industry-specific consequences stack on top. Healthcare facilities face regulatory action from CDPHE for records violations. Real estate licensees who fail to maintain transaction files for the full four years violate CRS 12-10-217 and risk suspension or revocation of their license by the Colorado Real Estate Commission.19Justia. Colorado Code 12-10-217 – Investigation The least visible consequence, and often the most costly, is spoliation in litigation, where destroyed records lead to adverse inferences or sanctions that can shift the outcome of a case entirely.