Closing a business
What happens to company data when a business closes, and what you have to keep
On this page
The short answer
What happens to company data when a business closes is up to you: the company still owns it, and the law still requires you to keep some of it. Most tax records are kept 3 years, employment tax records at least 4 years (source: IRS, how long should I keep records?), payroll records at least 3 years (source: U.S. Department of Labor, Fact Sheet 21: recordkeeping under the FLSA), and Forms I-9 until the later of 3 years after hire or 1 year after employment ends (source: USCIS, Handbook for Employers M-274, 10.0 Retaining Form I-9).
Everything else you can delete securely, or, with personal and client information removed, license to AI companies as a de-identified copy. Your hosted tools will not wait, so export first.
What happens to company data when a business closes
Filing dissolution papers does not touch your data. Email, drives, accounting files, CRM records and personnel files all stay where they are, owned by the company, until one of three things happens:
- A vendor deletes it. Hosted tools run their own deletion schedules once you stop paying. Microsoft, for example, says customer data left behind after you cancel might be deleted after 90 days and will be deleted no later than 180 days after cancellation (source: Microsoft Learn, what happens when a Microsoft 365 for business subscription ends). Deleting a Slack workspace is permanent (source: Slack Help Center, delete a workspace).
- You dispose of it. After the retention periods below have run, you can destroy records, using methods that protect personal information.
- You sell or license it. The company can sell assets during a wind-down. The SBA's closing checklist includes selling or liquidating assets and warns not to leave any out (source: U.S. Small Business Administration, close or sell your business).
The duties do not end at closing either. The SBA notes you may be legally required to keep tax and employment records, and says common guidelines run from three to seven years (source: U.S. Small Business Administration, close or sell your business). The table below gives the actual federal periods. For the bigger picture of what a closing company can still do with its records, start with our guide to selling company data when closing a business.
How long to keep business records after closing
These are the federal retention periods that apply to most US businesses. Each runs from the date shown, not from the date you close, so a business that closes this year may still be holding records from several years back.
| Record type | Keep how long | Source |
|---|---|---|
| Most tax records (income, expenses, returns) | 3 years, the IRS general rule | (see: IRS, how long should I keep records?) |
| Records behind a refund or credit claim | 3 years from filing or 2 years from paying the tax, whichever is later | (see: IRS, how long should I keep records?) |
| Returns where more than 25% of gross income went unreported | 6 years | (see: IRS, how long should I keep records?) |
| Worthless securities or bad debt deductions | 7 years | (see: IRS, how long should I keep records?) |
| No return filed, or a fraudulent return | Indefinitely | (see: IRS, how long should I keep records?) |
| Property and asset records | Until the limitations period expires for the year you dispose of the property | (see: IRS, how long should I keep records?) |
| Employment tax records | At least 4 years after the tax is due or paid, whichever is later | (see: IRS, how long should I keep records?) |
| Payroll records (FLSA) | At least 3 years | (see: U.S. Department of Labor, Fact Sheet 21: recordkeeping under the FLSA) |
| Time cards, wage rate tables, piece work tickets | 2 years | (see: U.S. Department of Labor, Fact Sheet 21: recordkeeping under the FLSA) |
| Form I-9 | 3 years after hire or 1 year after employment ends, whichever is later | (see: USCIS, Handbook for Employers M-274, 10.0 Retaining Form I-9) |
| Personnel and employment records (EEOC) | 1 year; for an involuntary termination, 1 year from the termination date | (see: EEOC, recordkeeping requirements) |
| Payroll records under the ADEA | 3 years | (see: EEOC, recordkeeping requirements) |
| Records related to a discrimination charge | Until final disposition of the charge or any lawsuit based on it | (see: EEOC, recordkeeping requirements) |
| OSHA 300 Log, 300A summary, 301 reports, privacy case list | 5 years following the end of the calendar year they cover | (see: OSHA, 29 CFR 1904.33, retention and updating) |
| Background checks and other consumer reports | No fixed federal period; dispose of securely when done | (see: FTC, disposing of consumer report information) |
The longest period wins
Many records fall under more than one rule. A payroll register is a tax record, an FLSA record and an ADEA record at once. Keep each record for the longest period that applies to it.
What to do with employee records when closing a business
Employee records carry the most rules and the most personal information. Handle them as a separate set from the start.
- Name who keeps payroll records. The IRS says your final Form 941 or 944 must include a statement showing the name of the person keeping the payroll records and the address where they will be kept (source: IRS, closing a business). Decide that before the last payroll runs.
- Keep payroll and wage records. The FLSA requires payroll records for at least three years and the records behind wage calculations, such as time cards, for two (source: U.S. Department of Labor, Fact Sheet 21: recordkeeping under the FLSA). The IRS says to keep all employment tax records for at least four years (source: IRS, closing a business).
- Keep each Form I-9 until its own date. For someone who worked under two years, that is three years from the first day of employment; for someone who worked longer, one year after they left. Paper, microfilm or electronic storage is allowed (source: USCIS, Handbook for Employers M-274, 10.0 Retaining Form I-9).
- Keep personnel records. The EEOC requires personnel and employment records for one year, payroll records under the ADEA for three, and anything tied to a charge until it is finally resolved (source: EEOC, recordkeeping requirements).
- Keep OSHA logs if you had them. The 300 Log, 300A summary and 301 reports stay for five years after the end of the year they cover (source: OSHA, 29 CFR 1904.33, retention and updating).
- Destroy background checks properly. The FTC's Disposal Rule covers employers that use consumer reports, and it expects you to burn, pulverize or shred paper and destroy or erase electronic files (source: FTC, disposing of consumer report information).
None of these records go into a data license. HR, payroll, health and performance files are always excluded, and they stay in your archive for the periods above.
Business record retention after closing a business: state rules, contracts and storage
The federal table is a floor. States can set their own retention periods for state taxes and employment records, and those vary from state to state. Check the revenue and labor agencies in every state where you had employees or filed returns.
Three other things set retention periods besides statutes:
- Contracts. Leases, customer agreements, loan documents and vendor contracts can require you to keep, return or delete records after the relationship ends.
- Open matters. An audit, a dispute or a pending claim means the related records stay until it is resolved, whatever the normal period is.
- Professional rules. If you were in a licensed profession, its rules on client files may set their own periods. Check the rules that bind your license.
Where you store the archive matters too. Exports sitting in a cancelled cloud account are not an archive. Pull them into storage you control, encrypt anything with personal information, and write down where everything is. Our guide to exporting company data before shutting down covers how to get each system out before access ends.
Can I delete company data after closing?
Yes, with two conditions: the retention period for that record has run, and nothing is pending that the record relates to. Within those limits, deleting old personal information is usually the safer choice, because data you no longer hold cannot leak.
- Check the period. Use the table above and your state rules. When in doubt, the longer period applies.
- Check for holds. Records tied to a discrimination charge stay until final disposition of the charge or any lawsuit based on it (source: EEOC, recordkeeping requirements). The same logic applies to tax years still open to audit.
- Dispose properly. For consumer information, the FTC rule calls for reasonable measures against unauthorized access, with examples such as burning, pulverizing or shredding paper and destroying or erasing electronic media (source: 16 CFR 682.3, proper disposal of consumer information (Cornell LII)).
- Mind vendor deletion buttons. Some deletions happen instantly. Microsoft says if you explicitly delete a subscription, SharePoint and OneDrive data is deleted immediately (source: Microsoft Learn, what happens when a Microsoft 365 for business subscription ends). Export before you press anything labelled delete.
Customer data and privacy when you close
Customer records are where closing companies take on the most risk, because they hold other people's personal information and often sit under contracts with their own terms.
- The FTC Disposal Rule. Anyone who uses consumer reports for a business purpose must dispose of that information with reasonable measures against unauthorized access (source: 16 CFR 682.3, proper disposal of consumer information (Cornell LII)). If you hire a document destruction company, the FTC suggests due diligence first, such as reviewing an independent audit, checking references, or confirming trade association certification (source: FTC, disposing of consumer report information).
- Customer contracts. Many agreements say what happens to the customer's data at the end: return it, delete it, or certify deletion. Do what they say before the people who know the contracts leave.
- Tax return information. If the business prepared returns for others, federal law makes it a crime to knowingly or recklessly disclose or use that information for anything beyond preparing the return (source: 26 U.S.C. 7216, disclosure of tax return information (Cornell LII)). It stays out of any sale or license.
- State privacy and breach laws. These vary by state and can apply to how you store and destroy personal information. Treat every archive as if it could be lost.
Keep, delete or license: sorting your records
Every record a closing business holds lands in one of three piles. Sorting them early is what makes the rest of the shutdown simple.
| Records | Keep | Delete | License |
|---|---|---|---|
| Tax returns, ledgers, receipts | Yes, for the IRS period | After the period runs | No |
| Payroll, I-9, personnel, OSHA logs | Yes, for each legal period | After the period runs, securely | Never |
| Background checks, consumer reports | Only as long as needed | Yes, under the FTC Disposal Rule | Never |
| Customer content held under contract | As the contract says | As the contract says | No |
| Client files (law, accounting, health) | Under professional rules | Under professional rules | Never |
| Internal email, chat, documents, SOPs | Copy of anything tied to a retained record | Optional | Yes, de-identified |
| Tickets, project and CRM history | Optional | Optional | Yes, de-identified |
| Code and engineering history | Optional | Optional | Yes, with secrets removed |
The third column is where value hides. Internal operating records, with names and personal details replaced, are what AI data programs license. Whether yours would interest a buyer depends on headcount, years of history and how complete the records are; our data value checker walks through the factors, and our guide to who buys data from closed companies covers which programs take them.
How a data license fits with your retention duties
A license does not replace your archive and does not move your duties to anyone else. Here is how the two fit together:
- The buyer gets a de-identified copy. Personal information is removed or replaced before delivery, and records like HR files never go in.
- You keep the originals. Your tax, payroll and employment records stay in your archive for their legal periods, exactly as they would without a license.
- The wind-down path decides who signs. In a dissolution, the company's officers or directors usually sign. In an assignment for the benefit of creditors, the assignee controls the assets. Our guide to ABC vs dissolution explains when a data sale can happen in each.
- Timing is everything. The records have to exist to be licensed. Export before you cancel, and keep someone with authority to sign until the license is done.
For program names and their published terms, see the buyer directory.
How Regulr is paid, and how we write these pages
Regulr is a sell-side advisor. When a business we introduce signs a license, we may be paid a fee by the buyer or through a program's referral terms. We list every program we can verify whether or not it pays us, order is never set by fees, and every figure is the company's own advertised term with a link to where it says so. Regulr has not closed a data deal yet, so nothing here describes our results.
Frequently asked questions
How long do I need to keep business records after closing?
It depends on the record. The IRS general rule for tax records is 3 years, rising to 6 years if more than 25% of gross income went unreported and 7 years for a worthless securities or bad debt deduction. Employment tax records are kept at least 4 years after the tax is due or paid. FLSA payroll records are kept at least 3 years, Form I-9 until the later of 3 years after hire or 1 year after employment ends, and OSHA injury logs 5 years after the year they cover. State rules can be longer.
Can I delete company data after closing my business?
Yes, once each record's retention period has run and nothing is pending. Keep anything tied to an open tax year, an audit, a discrimination charge or a lawsuit until it is finally resolved; the EEOC says charge records stay until final disposition of the charge or any suit. When you do delete, do it properly: the FTC's Disposal Rule calls for burning, pulverizing or shredding paper and destroying or erasing electronic media that hold consumer report information.
What do I do with employee records when closing a business?
Keep them in a secure archive for their legal periods. That means payroll records for at least 3 years under the FLSA, employment tax records for at least 4 years, Forms I-9 until the later of 3 years after hire or 1 year after each person left, personnel records for at least 1 year under EEOC rules, and OSHA logs for 5 years. Your final Form 941 or 944 must include a statement naming who will keep the payroll records and where. HR files never go into a data license.
Do I still have to keep I-9 forms after my business closes?
USCIS sets the I-9 retention period per former employee: the later of 3 years after the date of hire or 1 year after employment ends. Its handbook does not carve out an exception for businesses that close, so plan to keep each form until its own date passes. Paper, microfilm and electronic storage are all allowed.
Who keeps the payroll records after a business closes?
Someone you name. The IRS says the final Form 941 or 944 must include a statement with the name of the person keeping the payroll records and the address where they will be kept. That can be an owner, a former officer, or a records storage provider.
What happens to customer data when a business closes?
Nothing happens automatically, which is the problem. It stays in your systems until a vendor deletes it after cancellation or you dispose of it. Check customer contracts for return or deletion duties, keep what the law requires, and dispose of the rest securely. Customer content you hold under a contract never goes into a data license.
If I license my company data, can I delete the originals?
Not early. A data license gives the buyer a de-identified copy. Your retention duties stay with you, so you keep the original tax, payroll and employment records for their full periods and then dispose of them properly.
What happens to company email when a business closes?
It stays with your email provider until the subscription ends, and then the provider's own deletion schedule applies. Microsoft says data left behind after a business cancels might be deleted after 90 days and will be deleted no later than 180 days after cancellation. Export mailboxes before you cancel if you need them for records or for a license.
Sources
IRS, Department of Labor, USCIS, EEOC, OSHA, FTC, SBA, Microsoft, Slack and Cornell LII pages read on their own sites on November 8, 2026. Federal rules only; state rules vary.
- IRS, how long should I keep records?
- IRS, closing a business
- U.S. Department of Labor, Fact Sheet 21: recordkeeping under the FLSA
- USCIS, Handbook for Employers M-274, 10.0 Retaining Form I-9
- EEOC, recordkeeping requirements
- OSHA, 29 CFR 1904.33, retention and updating
- FTC, disposing of consumer report information
- 16 CFR 682.3, proper disposal of consumer information (Cornell LII)
- U.S. Small Business Administration, close or sell your business
- Microsoft Learn, what happens when a Microsoft 365 for business subscription ends
- Slack Help Center, delete a workspace
- 26 U.S.C. 7216, disclosure of tax return information (Cornell LII)
Brian Boesen · Founder, Regulr AI
Brian runs Regulr AI, which works for established businesses that want to license de-identified records to AI companies. He checks each program's published terms against its own pages and updates these guides when they change. Last updated November 8, 2026.
This page is general information, not legal advice, and Regulr is not a law firm. Rules vary by state, by profession and by contract, and they apply to your facts, not to a category. You approve exactly what is in scope before anything is shared.
Keep reading