Are You Keeping Workforce Data Longer Than You Need To?

When an employee leaves, HR closes the personnel file, processes the final paycheck, and shuts off system access. Copies of that employee’s information can remain in places HR does not manage: email archives, collaboration platforms, badge-access logs, fleet telematics systems, and the files of recruiting, payroll, and benefits vendors.

Some of those records have to be kept because federal employment regulations set minimum retention periods for them. Others stick around because a system’s default setting keeps them, and no one has set a deletion date. Two enforcement actions address how long companies keep personal data. The Federal Trade Commission’s (FTC) January 2026 order against General Motors limits how long the automotive company may keep drivers’ location data. The California Privacy Protection Agency’s (CPPA) September 2025 decision against Tractor Supply Co. was its first enforcement action involving job applicants.

Some Records You Have to Keep

The California Consumer Privacy Act (CCPA) does not restrict a business’s ability to comply with federal, state, or local laws. Equal Employment Opportunity Commission regulations require you to keep personnel and employment records for one year from the date the record was made or the personnel action was taken, whichever is later. If you terminate an employee involuntarily, keep the personnel records for one year from the termination date. If a discrimination charge is filed, you must keep the relevant personnel records until final disposition of the charge or any resulting lawsuit.

Fair Labor Standards Act regulations require you to keep payroll records for at least three years from the last date of entry. Badge logs, chat histories, and vehicle location data fall outside these rules unless they become part of those records, so you either set their retention periods or leave a system’s default setting in place.

What the FTC’s General Motors Order Says About Retention

On Jan. 14, 2026, the FTC finalized its order against General Motors LLC, General Motors Holdings LLC, and OnStar, LLC (collectively, GM). The agency alleged that GM collected drivers’ precise location and driving-behavior data and sold it to third parties, including consumer reporting agencies, without adequate notice or affirmative consent. The order applies to consumer vehicles, not employer fleets, but its retention terms are worth a close look.

One of the order’s provisions requires GM, within 180 days of the order’s effective date, to document, follow, and publish a retention schedule. For each type of covered driver data, the schedule must state the purpose for keeping it and set a specific deletion timeframe, which must be “limited to the shortest time necessary to fulfill the purpose for which the data was collected.” Provision VI also requires GM to delete covered driver data it collected before the order, with exceptions that include litigation holds and legal requirements.

GM is not the only company to get retention terms from the FTC. After data breaches, the agency imposed them in its January 2023 orders against Drizly, involving an alcohol delivery platform, and against Chegg, involving an education technology company whose breaches exposed information about employees as well as customers. Both orders require the company to document and follow a data retention schedule, and the Drizly order also required the company to destroy personal data it did not need to provide its products or services. If you collect location data from company vehicles or phones, the comparable schedule entries are the purpose for keeping trip-level records and the deadline for deleting them, including records about employees who have left.

California’s Privacy Law Applies to Employees, Too

Since Jan. 1, 2023, the CCPA, as amended by the California Privacy Rights Act, has covered personal information about a covered business’s California employees, applicants, and contractors. Under Civil Code section 1798.100(a), the business must tell those individuals, at or before collection, what categories of information it collects, why it collects them, and how long it intends to keep each category. If it cannot say how long, it must give the criteria it will use to set that period. The same section also bars the business from keeping the information longer than reasonably necessary for the purpose it disclosed.

On Sept. 30, 2025, the CPPA announced a decision requiring Tractor Supply Co. to pay $1.35 million to resolve claims that it violated the CCPA. According to the decision, Tractor Supply failed to notify California job applicants of their privacy rights and how to exercise them. “We made it an enforcement priority to investigate whether businesses are properly implementing privacy rights,” said Michael Macko, the agency’s head of enforcement.

The agency’s regulations add another layer. Under section 7150, effective Jan. 1, 2026, a business that uses automated processing to infer or extrapolate an employee’s performance at work or other characteristics from systematic observation must complete a risk assessment. The assessment is due before the processing begins, or by Dec. 31, 2027, if the processing began before Jan. 1, 2026. Section 7152 adds a retention question: the assessment must state how long the business will keep each category of personal information involved.

Why Former Employees’ Data Creates Breach Exposure

If you keep former employees’ data, those former employees are among the people you must notify after a breach and among the people who can join a class action. In Dougherty v. Bojangles’ Restaurants, Inc., current and former Bojangles employees allege that a 2024 ransomware attack exposed their Social Security numbers, financial account information, driver’s license numbers, and health information.

On Sept. 30, 2025, the U.S. District Court for the Western District of North Carolina dismissed an earlier version of the case for lack of standing. In 2026, the North Carolina Business Court allowed most of the plaintiffs’ claims to proceed and dismissed their negligence per se and invasion of privacy claims. The court let the declaratory judgment claim go forward because the complaint alleged that Bojangles continues to keep employee data while maintaining inadequate cybersecurity practices.

Where to Start

You do not have to tackle everything at once. Start a retention review with one category, such as applicant records, monitoring data, vehicle location data, or former employee files. Then work through these questions with IT:

• What information is collected, and for what purpose?
• Which internal systems and outside vendors hold it?
• Which laws, contracts, pending claims, or legal holds require it to be kept?
• Does the written retention schedule match actual system settings and vendor practices?
• Who approves deletion and exceptions, and how is deletion documented?
• What event starts each retention period, such as the date a record is made, a personnel action, or a termination?

Do not forget your vendors. Your contracts should require them to return or destroy workforce data when the service ends. When you offboard a vendor, end its system access, disable its integrations, and get written confirmation that the data was returned or destroyed.

Sarah Hutchins, Robert Botkin and Tatum Barbaree contributed to this article.