Illinois business records retention follows a three-year default under state law, but that floor is the exception rather than the rule for most documents you actually handle. Taxes, employment records, corporate minutes, workplace injury logs, and biometric data each carry their own timeline, and the longest applicable rule controls. Getting the period wrong in either direction is costly: destroy too early and you face penalties, adverse inferences in court, and lost tax deductions; keep too long and you increase your exposure in a data breach while paying to store material you no longer need.
The Three-Year Default and Why It Rarely Controls
The Illinois Uniform Preservation of Private Business Records Act allows any business record that Illinois law requires you to keep to be destroyed after three years, unless another law specifies a different retention period or condition.1Illinois General Assembly. Illinois Code 805 ILCS 410/2 – Destruction of Business Records The statute reaches accounting books, vouchers, canceled checks, payroll records, correspondence, and sales records.
Two categories are carved out of the three-year rule inside the same statute. Corporate minute books are excluded and should be kept indefinitely. Records of transactions involving weapons, explosives, or poisons are also excluded and must be preserved longer.2Illinois General Assembly. Illinois Code 805 ILCS 410 – Uniform Preservation of Private Business Records Act
In practice, the three-year default is a backstop. Most of the records a business worries about — tax returns, payroll, employment files, corporate governance, safety logs — fall under specific rules with longer timelines. Plan around those rules first and let the default catch whatever is left.
How Long to Keep Each Type of Record
Tax Records
The IRS applies different periods depending on what the return shows:
- Standard returns: three years after filing, if no other condition applies.
- Refund claims: three years from the original filing date or two years from the date the tax was paid, whichever is later.
- Underreported income exceeding 25% of gross income: six years.
- Worthless securities or bad debt deduction claims: seven years.
- Unfiled or fraudulent returns: indefinitely. There is no expiration.
Employment tax records must be kept for at least four years after the tax becomes due or is paid, whichever is later. Records supporting property — purchase price, improvements, depreciation — should be kept until the statute of limitations expires for the year you sell or dispose of the asset.3Internal Revenue Service. How Long Should I Keep Records This is where businesses most often get caught short. Purchase documentation for a building or piece of equipment gets tossed years before the sale, and the company cannot prove its cost basis when the return is audited.
Employment Records
Federal and Illinois rules overlap, and the longest applicable period wins. The Fair Labor Standards Act requires payroll records, collective bargaining agreements, and sales and purchase records to be kept for at least three years. Underlying wage-computation records — time cards, piece-work tickets, wage rate tables, work schedules — must be kept for two years.4U.S. Department of Labor. Fact Sheet #21: Recordkeeping Requirements under the Fair Labor Standards Act (FLSA)
EEOC regulations require all personnel and employment records to be retained for one year, extending to one year from the date of termination for involuntarily terminated employees. Payroll records under the Age Discrimination in Employment Act must be kept for three years. Employee benefit plans and written seniority or merit systems must be preserved for the entire time they are in effect plus at least one year after termination. When an EEOC charge has been filed, all related records must be preserved until final disposition.5U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
The Illinois Department of Employment Security requires employers to retain employment records — worker names, Social Security numbers, wages paid per pay period, and dates of service — for five years after the records are made. If a contribution assessment or collection action is pending, the records must be preserved until that matter is resolved.6Illinois General Assembly. Illinois Administrative Code Section 2760 – Records Under the Illinois Wage Payment and Collection Act, employers must maintain copies of employee pay stubs for at least three years after the date of payment, regardless of whether the employee is still with the company. Employees can request copies, and employers must provide them within 21 calendar days.
Five years covers most situations across all these rules. Use that as your floor unless a specific record has a longer obligation attached.
Corporate Governance Records
The Illinois Business Corporation Act requires every corporation to maintain complete books and records of account, minutes of shareholder and board meetings, and a record of shareholders showing names, addresses, and shareholdings. These records must be kept at the corporation’s registered office, principal place of business in Illinois, or at a transfer agent’s office within the state.7Illinois General Assembly. Illinois Code 805 ILCS 5/7.75 – Corporate Records Examination by Shareholders Keep them indefinitely. The statute assumes they exist for as long as the corporation does.
A separate risk sits on the filing side. Under 805 ILCS 5/12.40, the Illinois Secretary of State can administratively dissolve a corporation that fails to cure defaults such as missed annual reports within the notice period — 90 days for most defaults, 30 days for others.8Illinois General Assembly. Illinois Code 805 ILCS 5/12.40 Reinstatement requires filing up to six years of delinquent annual reports and paying every outstanding fee.9Illinois Secretary of State. Reinstatement Filing – Corporation A dissolved corporation cannot conduct business in Illinois until it is reinstated.
Workplace Safety Records
Federal OSHA regulations require employers to retain injury and illness logs (Form 300), the annual summary, privacy case lists, and individual incident reports (Form 301) for five years following the end of the calendar year the records cover. OSHA also requires you to update the stored logs during the five-year period if you discover a new recordable injury or reclassify a previously recorded case.10Occupational Safety and Health Administration. 1904.33 – Retention and Updating Filing the forms and forgetting them is not compliance if the underlying facts change.
Audit Records for Public Companies
The Sarbanes-Oxley Act imposes additional obligations on publicly traded companies and their auditors. The SEC requires accountants who audit or review an issuer’s financial statements to retain all workpapers, correspondence, memoranda, and other documents related to the audit for seven years after the engagement concludes.11Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews
Biometric Data
The Illinois Biometric Information Privacy Act applies to any private entity that collects biometric identifiers — fingerprints, retina scans, facial geometry, voiceprints — from individuals in Illinois. Before collecting the data, the business must obtain informed consent and publish a written retention schedule. Biometric data must be permanently destroyed when the original purpose for collecting it has been satisfied or within three years of the individual’s last interaction with the business, whichever comes first.
Damages under BIPA are per violation: $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, whichever is greater than actual damages, plus reasonable attorney fees and costs.12Illinois General Assembly. Illinois Code 740 ILCS 14/20 A company that scans hundreds of employees’ fingerprints without proper consent can face aggregate liability in the millions.
Consumer Personal Information
The Illinois Personal Information Protection Act requires any business that owns, licenses, maintains, or stores records containing personal information about an Illinois resident to implement reasonable security measures protecting against unauthorized access, acquisition, destruction, use, modification, or disclosure. Contracts with third parties handling the data must require equivalent security. A breach triggers mandatory notification to affected Illinois residents at no charge to them.13Justia Law. Illinois Code 815 ILCS 530 – Personal Information Protection Act
Electronic Storage and Reproductions
The Illinois Electronic Commerce Security Act establishes that electronic records and signatures cannot be denied legal effect simply because they are in electronic form.14Illinois Commerce Commission. Illinois Code 5 ILCS 175 – Electronic Commerce Security Act A digitally stored contract, invoice, or set of meeting minutes carries the same weight as a paper original, provided the record’s integrity can be shown.
The Uniform Preservation of Private Business Records Act also allows reproductions, including digital copies, to satisfy record-keeping requirements. The reproduction must be made in the regular course of business or under a general records plan, and the business must be able to produce enlarged copies at original size upon request by a state agency.2Illinois General Assembly. Illinois Code 805 ILCS 410 – Uniform Preservation of Private Business Records Act Scanning paper documents and storing them electronically is fine as long as your system can reliably retrieve and print them.
When the Retention Schedule Stops Applying: Litigation Holds
Once litigation is reasonably anticipated — not just filed, but foreseeable — the business has a duty to suspend routine document destruction and preserve anything potentially relevant. This is a litigation hold, and failing to implement one is the fastest way to draw spoliation sanctions.
The trigger is earlier than most businesses expect. A demand letter, a government inquiry, a complaint from a customer’s attorney, or facts that make a lawsuit probable can all attach the obligation. Continuing routine destruction after that point can transform an innocent records policy into evidence of bad faith.
A hold covers both paper and electronic records, including emails, text messages, database entries, and metadata. It must be communicated to every employee who might have relevant documents and must override automated deletion schedules. Courts evaluate whether the party took “reasonable steps,” so documenting the hold itself matters: who was notified, when, and what instructions they received.
Penalties for Destroying Records Too Early
The consequences fall into several categories, and a single failure often triggers more than one.
In litigation, the immediate consequence is an adverse inference. Under Federal Rule of Civil Procedure 37(e), a court can impose curative measures when electronically stored information is lost because a party failed to take reasonable preservation steps. If the loss was intentional — meaning the party acted with the intent to deprive the other side of the evidence — the court can presume the lost information was unfavorable, instruct the jury accordingly, or dismiss the case entirely.15Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
Illinois courts apply a similar framework. Under Illinois Supreme Court Rule 219(c), a trial court can sanction a party that fails to produce relevant evidence because it was destroyed before litigation was filed. Illinois case law establishes that a potential litigant has a duty to take reasonable measures to preserve relevant and material evidence, and that duty can arise from a contract, statute, or the special circumstances of the situation. You do not need to wait for a lawsuit to be filed for the obligation to attach.
Criminal exposure exists for the most serious conduct. Federal law under 18 U.S.C. § 1519 makes it a crime to knowingly destroy records with intent to obstruct a federal investigation, punishable by up to 20 years in prison.16Office of the Law Revision Counsel. 18 USC 1519 The statute is not limited to auditors or public companies, and formal investigation is not required at the time of destruction; acting “in contemplation of” a federal matter is enough.
Administrative dissolution by the Illinois Secretary of State sits on top of these consequences for corporations that fall behind on filings connected to their record-keeping obligations.8Illinois General Assembly. Illinois Code 805 ILCS 5/12.40
Disposing of Records Properly
Once records have passed their retention period, destruction needs to be handled deliberately, particularly for records containing personal or financial information. Federal law under the Fair and Accurate Credit Transactions Act requires any person or entity that possesses consumer information derived from consumer reports to dispose of it properly. The rule applies to corporations, partnerships, government agencies, and individuals.17eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information
For paper, shredding or incineration is the standard. For electronic records, deleting files is not enough; data should be overwritten or the storage media physically destroyed. BIPA requires biometric data to be permanently destroyed on the schedule the business has published, and no later than three years after the individual’s last interaction with the business.
Businesses handling personal information about Illinois residents also need to account for PIPA’s security requirements during disposal. A record dumped unsecured could itself constitute a security failure triggering breach notification.
Building the Retention Schedule
The number of overlapping periods makes a written schedule essential. Without one, individual employees make ad hoc decisions, and those decisions are almost always wrong in one direction or the other. A workable schedule maps each record category to its governing rule, assigns a destruction date, and identifies who is responsible for the decision.
At minimum, plan to retain:
- Corporate governance documents (minutes, shareholder records, bylaws): indefinitely.
- Tax returns and supporting documents: at least seven years, covering the longest IRS lookback periods.
- Employment records: five years, satisfying the Illinois Department of Employment Security.
- OSHA logs: five years, with a process for updating them when new information arises.
- General business records: three years under the state default.
- Biometric data: on a separate, publicly available BIPA policy with destruction timelines built in.
Review the schedule annually. New regulations, changes in operations, or new technology such as biometric time clocks can create obligations that did not exist when the schedule was written. A retention schedule that sits untouched for five years is almost as dangerous as not having one at all.