Are You Keeping Employee Information Longer Than Necessary?

Human resources departments collect and maintain significant amounts of sensitive employee information, including Social Security numbers, payroll records, benefits enrollment forms, dependent information, and medical documentation. While much of this information must be retained for legal, regulatory, or business purposes, keeping records longer than necessary can create unnecessary security and privacy risks.

Employers often focus on protecting information they actively use but may overlook the sensitive data stored in archived files, old email messages, shared drives, and outdated employee records. Establishing appropriate retention and disposal practices can help reduce these risks.

Why Keeping Old Records Creates Security Risks

Every additional copy of sensitive employee information creates another opportunity for unauthorized access or disclosure. Records that are no longer needed may remain accessible in locations that are not regularly monitored or reviewed.

For example, an HR department may retain spreadsheets containing employee Social Security numbers from previous open enrollments, copies of identification documents submitted years ago, or emails containing medical information about former employees.

If an employee’s email account or a shared drive is compromised, attackers may gain access to historical information that serves no current business purpose.

Retaining unnecessary information can also increase the scope, complexity, and cost of responding to a security incident. The more sensitive information an organization maintains, the more information it may need to review if a breach occurs.

Understand Legal Recordkeeping Requirements

Before deleting employee records, employers must understand their legal retention obligations. Different laws impose different requirements depending on the type of record and the employer’s circumstances.

For example:

• Employment records: Federal employment laws may require certain personnel, hiring, and employment records to be retained for specified periods.
• Payroll records: The Fair Labor Standards Act generally requires employers to retain payroll records for at least three years, with certain supporting wage calculation records retained for at least two years.
• Benefits records: ERISA generally requires employers subject to its recordkeeping provisions to retain records supporting required reports and disclosures for at least six years after the applicable filing date. Other benefits-related records may be subject to different requirements.
• Tax records: Employers must comply with applicable IRS recordkeeping requirements for employment taxes and other tax-related information.
• Medical and leave records: Records maintained under laws such as the FMLA, ADA, and HIPAA may have separate retention, confidentiality, and documentation requirements.

These requirements are not interchangeable, and some records may be subject to multiple laws. State laws, contractual obligations, pending litigation, audits, and government investigations may also require longer retention periods.

Employers should therefore establish retention schedules based on the specific categories of information they maintain rather than applying one retention period to all employee records.

Where Unnecessary Information Often Accumulates

Sensitive information is not always stored in an organization’s official HR or benefits administration system. Additional copies may exist in:

• Email inboxes and archived messages containing employee documents or attachments.
• Spreadsheets downloaded for payroll reconciliation or benefits administration.
• Shared network folders containing historical employee census files.
• Local computer folders and employee desktops.
• Paper files containing outdated enrollment forms or identification documents.
• Files maintained by former employees or individuals whose job responsibilities have changed.

Employers should periodically review these locations to identify records that are no longer needed and determine whether they can be securely disposed of.

Secure Disposal Is Just as Important as Secure Storage

Deleting a file or placing a document in the trash does not necessarily mean the information has been securely destroyed.

Paper documents containing sensitive employee information should be shredded or disposed of through an approved confidential destruction service.

Electronic records should be deleted using methods appropriate to the sensitivity of the information and the storage system involved. Employers should work with their IT departments to establish procedures for securely deleting files, managing archived information, and addressing records contained in backup systems.

Employers should also consider whether third-party vendors retain copies of employee information after services end and whether contracts establish appropriate retention and disposal requirements.

Establish a Consistent Retention and Disposal Process

An effective information retention program should include written policies identifying which records must be maintained, how long they must be retained, where they should be stored, and when they should be securely disposed of.

HR departments should coordinate with legal, compliance, and IT personnel to ensure that retention schedules satisfy applicable requirements and that records subject to litigation holds, audits, or investigations are preserved.

Employees should also receive guidance on avoiding unnecessary copies of sensitive information and using approved systems rather than storing employee records in personal folders or email accounts indefinitely.

The Bottom Line

Protecting employee information is not only about preventing unauthorized access. It also involves limiting how much sensitive information an organization retains.

By maintaining appropriate retention schedules, periodically reviewing stored records, and securely disposing of information that is no longer required, employers can reduce their exposure to security incidents while continuing to meet their legal and regulatory obligations.

The goal is not to delete records prematurely, but to ensure that sensitive employee information is retained only for as long as there is a legitimate legal or business reason to keep it.