How Long Do You Have to Keep Legacy ERP Data? Retention Requirements by Industry

“Can we just delete it?” is the first question every decommission project gets, and the answer is almost always no. The second question — “then how long do we have to keep it?” — is the one that actually determines what your archive needs to do.

This is a practical summary for the person who owns the legacy ERP, not legal advice; your records-retention policy and counsel have the final word. But these are the rules that show up in nearly every decommission we do.

The baseline: what’s in an ERP and who regulates it

An ERP holds four kinds of records with retention obligations: payroll and employment records, tax records, financial records, and — for healthcare and public sector — records covered by industry-specific law. Each has a different clock, and the archive has to satisfy the longest one that applies.

Payroll and employment

• IRS employment tax records: at least four years after the due date of the tax or the date paid, whichever is later.
• FLSA payroll records: three years for payroll records, two years for the time cards and wage-rate tables behind them.
• ERISA (benefits): six years for plan records; some benefit-determination records effectively indefinitely.
• State law: frequently longer. California, for example, requires payroll records be kept for three years but personnel records for four, and some states go to seven.

In practice, organizations that archive a legacy HR/payroll system keep everything. The incremental cost of keeping 1999 alongside 2019 is close to zero, and “we deleted it per policy” is a harder conversation than “here it is.”

Tax and financial

• Federal tax: the IRS’s general rule is three years from filing, six if income was substantially understated, indefinitely if no return was filed. Most organizations treat seven years as the floor for supporting records.
• Sarbanes-Oxley: audit and review workpapers seven years. If you’re a public company, the ERP data that supports past audited financials falls into scope.
• GL and sub-ledger detail: most retention schedules say seven to ten years; many organizations keep permanently because it’s the only record of what happened.

Healthcare

• HIPAA: documentation required by the Security and Privacy Rules — policies, access logs, risk assessments — must be retained six years (45 CFR 164.316 and 164.530). HIPAA itself does not set a medical-record retention period; state law does, typically five to ten years and longer for minors.
• CMS: providers filing cost reports must keep supporting records at least five years after the cost report is settled; Medicare managed care organizations, ten years.
• The practical effect: a hospital’s legacy Lawson or PeopleSoft system holds payroll, GL, supply chain, and often employee health-plan data, and the retention floor is ten years with a strong case for longer. Boston Medical Center, Mayo Clinic, and Broward Health are among the health systems that keep retired ERP history in APIX rather than in a live system.

Public sector and education

• State public records laws set schedules by record type; financial records commonly seven to ten years, personnel records the length of employment plus a period, and some records permanent.
• Federal grant recipients (2 CFR 200.334): records retained three years from submission of the final expenditure report — but that’s a floor, and audits can extend it.
• Education (FERPA) governs disclosure more than retention, but state schedules for school districts often require permanent retention of certain personnel and payroll records.
• Public entities also face a specific pressure: open-records requests. A retired ERP that can’t be searched by a records officer is a liability. Utilities and school districts like DC Water and Chesapeake Public Schools archive with a searchable interface for exactly this reason.

Financial services

• SEC and FINRA rules (17a-4, and Rule 17a-3 for broker-dealers) impose six-year retention with specific format requirements for certain records.
• Insurers face state insurance department schedules that vary by state, commonly seven years and longer for claims and policy records.

What this means for the archive

Three requirements fall out of the table above:

1. Keep everything, for at least ten years, and probably indefinitely. The cost of storage is trivial; the cost of a missing record is not.
2. The archive must be searchable by a non-technical person — the payroll specialist answering an IRS letter, the records officer answering a public-records request — because retention is only useful if you can produce the record.
3. Access must be controlled and logged, because the same data that must be retained is the data HIPAA and state privacy laws say must be protected.

That is the specification for an application archive rather than a backup tape or a raw export. APIX is built to it: the full application history in your own AWS account, role-secured, searchable, SOC 2 audited.

If you’re working out what your organization is actually obligated to keep before you retire a system, book a discovery session — we’ll map your ERP’s data to the retention rules that apply to you.