When it comes to background checks, most employers focus on accuracy, compliance, and turnaround times, but record retention is just as important — and often overlooked. In an attempt to be thorough, you may be asking questions like how long should you keep background check records? What are the legal requirements? And what does best practice look like?
Today, we’re breaking down the federal regulations governing background check record retention, explaining how long VICTIG retains your data and why, and sharing what employers should consider with their own retention policies.
What Counts as a Background Check Record?
If you’ve obtained any of the following through a Consumer Reporting Agency (CRA), then record retention guidelines apply:
- Criminal history reports
- Driving records
- Drug screening results
- Employment verifications and reference checks
Additionally, any disclosures and authorizations provided to candidates as part of the background check process are considered part of the record and should be retained accordingly.
What the Law Requires
Fair Credit Reporting Act (FCRA)
While the FCRA governs how employers use background checks, it does not establish a specific retention period for records.
Equal Employment Opportunity Commission (EEOC)
The EEOC requires that employers retain all hiring records for at least one year from the date the record was made or the personnel action was taken — whichever comes later. This includes background check results, consent forms, or other related documents sent to the subject of the background check.
Title VII of the Civil Rights Act of 1964
Applies to employers with 15 or more employees and reinforces the one-year record retention standard for employment decisions.
Industry Best Practices
While federal law sets a one-year minimum, some legal experts recommend keeping background check records for up to 5 years, especially in highly regulated industries where audits are common.
Keep in mind that it’s important to assess your specific industry requirements, which may impose longer retention periods for compliance purposes (e.g., healthcare, finance, or transportation).
How Long Does VICTIG Retain Your Data?
At VICTIG, we take both compliance and data security seriously.
We retain all disclosures, authorizations, and background check reports for four years. This policy intentionally goes beyond the federal minimum while still balancing data security concerns. By limiting how long we retain sensitive data, we reduce the risk of exposure in the event of a data breach — while still supporting your documentation needs.
Final Thoughts: Striking the Right Balance
Navigating federal record retention requirements isn’t just about checking a box: it’s about protecting your business and your candidates. By understanding the laws, aligning with best practices, and working with a screening partner that prioritizes both compliance and security, you can stay protected and prepared.
If you have any questions or need help reviewing your retention policy, we’re here to help. At VICTIG, we’re more than just a background check provider — we’re your partner in hiring compliance and risk mitigation.
