Most private employers must keep background check and related hiring records for at least one year from the date the record was made or the personnel action was taken, whichever is later, under EEOC recordkeeping rules. Educational institutions and state or local government employers have a two year minimum under the same rules. Separate federal rules cover how you must dispose of the information when the retention period ends, and DOT regulated employers have their own longer schedules for driver files and drug test results. None of this is legal advice, and the right retention period for your organization depends on your industry, your state, and your own counsel.
Background check records sit at the intersection of federal rules that were not written with each other in mind. Equal employment recordkeeping rules set how long to keep the hiring record. The FTC’s disposal rule sets how to get rid of consumer report information once you no longer need it. DOT rules add their own, longer schedules for regulated drivers. This guide walks through each layer, with retention periods verified against the regulation or agency guidance that sets them, and closes with a comparison table for quick reference.
Why background check retention is not one rule
A background check report is not a single kind of record. The application, the authorization and disclosure forms, the consumer report itself, any adverse action notices, and the hiring decision are separate documents that can be governed by different rules. EEOC recordkeeping obligations apply to the personnel and employment records an employer generates during hiring. The FTC’s disposal rule applies specifically to consumer information, which includes background check reports obtained from a consumer reporting agency such as Reveal. DOT rules layer on top of both for employers who hire commercial drivers. Employers running an employment background check program should plan for all three.
EEOC recordkeeping rules for hiring records
Under 29 CFR 1602.14, any personnel or employment record an employer makes or keeps, including application forms submitted by applicants and other records related to hiring, promotion, demotion, transfer, layoff, or termination, must be preserved for one year from the date the record was made or the personnel action involved, whichever occurs later. This one year minimum applies to records for candidates who were not hired as well as to employees, so a background check tied to a rejected applicant falls under the same rule as one tied to a new hire.
Two variations are worth knowing. First, if an employee is involuntarily terminated, the personnel records for that individual must be kept for one year from the date of termination. Second, educational institutions and state or local government employers are held to a two year retention period under the same set of EEOC recordkeeping rules, rather than the one year period that applies to most private employers.
There is also an important exception that overrides the standard clock. If a discrimination charge or lawsuit is filed, the employer must preserve all personnel records relevant to that charge or action until it is finally resolved, even if the one or two year period would otherwise have already run out.
Separately, the Age Discrimination in Employment Act’s recordkeeping rule at 29 CFR 1627.3 requires payroll records to be kept for three years, while most other personnel records connected to hiring, promotion, and termination decisions follow the same one year standard.
The FTC Disposal Rule for consumer report information
A background check report is “consumer information” under the FTC’s disposal rule, codified at 16 CFR Part 682. The rule requires any person or business that maintains or possesses consumer information for a business purpose to take reasonable measures to protect against unauthorized access to, or use of, that information when it is disposed of. The rule does not set a specific retention period; it governs what happens at the moment you get rid of the record.
The regulation gives examples of reasonable disposal measures, including burning, pulverizing, or shredding paper documents so the information cannot practicably be read, and destroying or erasing electronic files or media so the data cannot practicably be read or reconstructed. Employers who rely on third party vendors for shredding or data destruction are still expected to exercise due diligence in selecting a qualified vendor. Because the rule covers “consumer information,” it applies to background check reports and information derived from them, not only the raw file received from the reporting agency.
DOT regulated retention for drivers
Motor carriers regulated by the Federal Motor Carrier Safety Administration have their own, longer retention schedule that sits on top of the EEOC and FTC rules.
Driver qualification files
Under 49 CFR 391.51, a motor carrier must retain a driver’s qualification file for as long as that person is employed as a driver, and for three years after the employment relationship ends. Certain documents inside the file, such as the annual review of driving record and medical certification, can be removed once that three year mark is reached.
Drug and alcohol testing records
Under 49 CFR 382.401, the retention period for drug and alcohol testing records depends on the type of record. Verified positive drug test results, alcohol test results of 0.02 or greater, refusals to test, and related follow-up testing and evaluation records must be kept for five years. Records related to the alcohol and controlled substances collection process, apart from calibration documentation, must be kept for two years. Negative and canceled test results generally need to be kept for one year. Employers building out a driver hiring program can pair this schedule with a broader transportation background check process, and our related post on DOT background check requirements for drivers walks through the underlying screening rules in more detail.
Why many employers keep records longer than the legal minimum
It is common practice, not a legal requirement described here, for employers to hold hiring and background check records well past the one or two year EEOC minimum. State statutes of limitations for employment related claims, such as failure to hire or negligent hiring claims, frequently run longer than the federal recordkeeping minimum, and a record already disposed of cannot help defend against a claim filed within that longer window. This is a risk management decision each employer needs to make for its own situation, in its own state, with its own counsel, rather than something this article can tell you to do. If an organization extends retention beyond the regulatory floor, the FTC disposal rule still applies the moment the file is ready to be disposed of.
Background check record retention at a glance
| Record type | Verified minimum retention | Source |
|---|---|---|
| Hiring and personnel records, private employers | 1 year from date of record or personnel action, whichever is later | 29 CFR 1602.14 (EEOC) |
| Hiring and personnel records, educational institutions and state or local government | 2 years from date of record or personnel action | 29 CFR 1602 (EEOC) |
| Records for an involuntarily terminated employee | 1 year from date of termination (private employers) | 29 CFR 1602.14 (EEOC) |
| Records relevant to a filed discrimination charge or lawsuit | Until final resolution of the charge or action | 29 CFR 1602.14 (EEOC) |
| Payroll records | 3 years | 29 CFR 1627.3 (ADEA) |
| Consumer report information, at disposal | No set holding period; reasonable measures required when disposed of | 16 CFR Part 682 (FTC Disposal Rule) |
| Driver qualification file (DOT regulated) | Duration of employment plus 3 years after | 49 CFR 391.51 (FMCSA) |
| Verified positive drug or alcohol test, refusal (DOT regulated) | 5 years | 49 CFR 382.401 (FMCSA) |
| Drug or alcohol testing collection process records (DOT regulated) | 2 years | 49 CFR 382.401 (FMCSA) |
| Negative or canceled drug test result (DOT regulated) | 1 year | 49 CFR 382.401 (FMCSA) |
Secure disposal practices for background check records
Once a record’s retention period has run, and it is not subject to a litigation hold or a longer internal policy, secure disposal is what closes the loop under the FTC disposal rule. Practical steps many employers build into a retention policy include:
- Shredding, pulverizing, or burning paper files rather than placing them in general recycling or trash.
- Using disk wiping or media destruction methods that make electronic files unreadable and unreconstructable, rather than simply deleting a file.
- Vetting any third party shredding or data destruction vendor before relying on it, since the rule expects due diligence in vendor selection.
- Setting a documented retention schedule so records are disposed of on a consistent timeline, rather than kept indefinitely by default or deleted inconsistently.
- Flagging any file connected to an open dispute, charge, or investigation so it is excluded from routine disposal until that matter is resolved.
A written policy makes it easier to apply the right rule to the right record. A general hiring file, a DOT driver qualification file, and a drug test result can live in the same personnel folder but carry different retention clocks, and a policy that treats them the same risks disposing of a DOT record too early or holding a general hiring record longer than necessary. Our overview of criminal background check services can help map which documents exist in a typical file, and our pricing page outlines how Reveal packages screening so records stay consistent across a hiring program. Employers screening on an ongoing basis may also want our post on continuous background check monitoring, since monitoring programs generate their own stream of records that need a place in the schedule.
Frequently asked questions
How long should an employer keep background check records?
There is no single federal retention period for background check records. Under EEOC recordkeeping rules (29 CFR 1602.14), employers covered by federal anti-discrimination law generally must keep personnel and employment records, including hiring records tied to a background check, for one year from the date the record was made or the personnel action was taken, whichever is later. Educational institutions and state or local governments have a two year retention period under the same regulations. Many employers choose to keep records longer to align with state statutes of limitations or industry-specific rules.
Do I need to keep background check records for applicants I did not hire?
Yes. EEOC recordkeeping rules apply to records related to hiring, not only to records for people who were hired. Application forms, screening results, and related hiring records for rejected applicants fall under the same one year minimum retention period for private employers, or two years for educational institutions and state or local governments, under 29 CFR 1602.14.
What is the FTC Disposal Rule and how does it apply to background check records?
The FTC Disposal Rule (16 CFR Part 682) requires anyone who maintains or possesses consumer information for a business purpose, including background check reports, to take reasonable measures to protect against unauthorized access to that information when disposing of it. Reasonable measures include burning, pulverizing, or shredding paper records and destroying or erasing electronic records so the information cannot practicably be read or reconstructed.
How long must DOT regulated employers keep driver background check and drug test records?
Motor carriers regulated by the FMCSA must keep a driver qualification file for as long as the driver is employed and for three years after employment ends, under 49 CFR 391.51. Drug and alcohol testing records have their own schedule under 49 CFR 382.401: verified positive tests, refusals, and related records for five years; records tied to the testing collection process for two years; and negative or canceled test results for one year.
Why do some employers keep background check records longer than the legal minimum?
Many employers retain hiring and background check records beyond the regulatory minimum as a common risk management practice, since state statutes of limitations for employment claims can run longer than one or two years and records may be needed to respond to a claim. This is a business decision each employer should make with its own counsel, not a specific legal requirement described here.
What happens to the retention period if a charge or dispute is filed?
If a discrimination charge, lawsuit, or similar action is filed, EEOC rules require the employer to preserve all personnel records relevant to that charge or action until it is finally resolved, even if the standard one or two year period would otherwise have expired, under 29 CFR 1602.14. Employers handling an active background check dispute should also review our guide to how applicant disputes are resolved, since a disputed file is exactly the kind of record that should be held past its normal retention date.
Related Reading
This article is general information, not legal advice. Recordkeeping and disposal requirements vary by jurisdiction, by industry, and by the specific facts of your hiring program, and they change over time. Confirm your current obligations with your own counsel before finalizing a retention policy.
