Colorado does not have one retention period that applies to every record or organization. Requirements depend on the record’s purpose, the organization’s role, and applicable state and federal laws. Public agencies must follow records-management rules and approved retention schedules, while private businesses may need to meet tax, employment, privacy, and industry-specific obligations. A documented retention program helps organizations keep records long enough to meet legal requirements, protect them when litigation is possible, and dispose of them securely when they are no longer needed.
How Colorado Records Retention Laws Work
Colorado’s records-retention framework is made up of several laws, regulations, and official schedules—not a single statewide timetable for every document. Public records are subject to Colorado’s records-management statutes and applicable retention schedules. Private organizations generally determine retention periods by identifying the laws and business needs that apply to each record category.
Retention is different from access. The Colorado Open Records Act, or CORA, establishes public access rights for certain government records, subject to statutory exceptions. It does not mean every record must be kept forever, nor does it set one universal retention period. Records-management rules address how long records are preserved and how they may be disposed of; access laws address whether records can be inspected or copied.
The practical rule is to identify the record, its legal requirements, and any preservation hold before destruction. An organization should not rely on a general rule such as “keep everything for seven years” without checking whether a longer or shorter period applies.
Retention Requirements for Colorado Public Records
Colorado public agencies—including state and local government bodies—must manage public records under applicable state law and records schedules. Colorado Revised Statutes Title 24, Article 80 addresses public records management. The Colorado State Archives provides guidance, schedules, and resources for government records programs.
Government offices should use the retention schedule that applies to their agency and record series. A schedule identifies categories of records and specifies how long they must be retained, as well as whether they may be destroyed or require archival review. Requirements can differ among state agencies, counties, municipalities, school districts, and other public entities. A schedule for one office should not automatically be applied to another.
Before destroying a government record, staff should confirm the schedule, calculate the retention period from the correct triggering event, and document the action in accordance with agency procedures. If a record has archival value or is subject to a preservation request, destruction may be restricted even if its ordinary retention period has passed.
CORA and records preservation
CORA is codified at C.R.S. § 24-72-200.1 et seq. and generally gives the public access to public records, subject to exemptions and other legal limits. A request may concern paper files, emails, databases, messages, photographs, or other recorded information. Agencies need procedures for locating responsive records and reviewing them for disclosure or applicable exceptions.
When a CORA request arrives, an agency should promptly preserve potentially responsive records and follow its legal review process. Routine deletion should not be used to evade a request. The precise response obligations and deadlines can depend on the circumstances and current statutory language, so agencies should consult their records officer or counsel for a specific request.
Private Businesses: No Single Colorado Retention Schedule
Most private businesses are not subject to the government retention schedules used by public agencies. Instead, they must consider the requirements that apply to particular records, such as tax rules, employment laws, contracts, licensing requirements, privacy obligations, and litigation or audit needs. A business may also need to preserve records under a subpoena, investigation, insurance claim, or legal hold.
Colorado’s laws on personal information affect how businesses protect and dispose of certain data. Under C.R.S. § 6-1-713, covered entities must take reasonable steps to protect certain personal identifying information and, when disposing of documents containing it, make the information unreadable or undecipherable. This can apply to records on paper and electronic media. The rule is not a universal retention period: it concerns safeguarding and disposal when information is no longer needed, alongside any other applicable retention duties.
Businesses that process personal data may also need to assess the Colorado Privacy Act, C.R.S. § 6-1-1301 et seq. Its obligations depend on whether an entity and its data processing fall within the law’s scope and exemptions. The act includes requirements involving personal data, consumer rights, and data minimization. It does not create a simple retention period for every business record.
Common Record Categories and Retention Considerations
The following examples are starting points, not a substitute for checking the current law, agency schedule, contract, or professional requirements that apply. Federal laws may govern records held by Colorado organizations, and specialized rules can require different periods.
| Record category | Key retention considerations |
|---|---|
| Tax records | Federal and Colorado tax rules may set different limitation periods. The IRS generally advises keeping records that support tax returns until the period of limitations expires; some circumstances require longer retention. Property, employment-tax, and loss records may have different rules. |
| Employment and payroll | Federal requirements under laws such as the Fair Labor Standards Act and Title VII set recordkeeping obligations. The required period varies by record type. Colorado wage, leave, and other employment laws may add obligations. |
| Medical and health information | HIPAA applies to covered entities and business associates, but its Privacy Rule does not establish a general medical-record retention period. Other federal, state, licensing, and payer rules may govern the records of providers. |
| Contracts and business transactions | Retention depends on contract terms, tax treatment, applicable limitation periods, warranties, and the likelihood of a dispute. Keep supporting documentation with the relevant transaction. |
| Consumer personal information | Apply security and secure-disposal requirements, including applicable Colorado law. Retain only as long as justified by legal, operational, or other permitted purposes. |
| Government records | Use the applicable Colorado State Archives or agency-approved schedule. CORA access obligations and preservation requests may affect handling and disposal. |
Retention Periods: What Organizations Should Check
There is no reliable “one-size-fits-all” list of retention periods for all Colorado records. Even within one category, the correct period may depend on the record’s function and the event that starts the clock. A payroll record, for example, may be governed by different rules than an employee’s personnel file. A tax document supporting an asset may need to be retained beyond the usual period for a filed return.
For tax records, the IRS commonly describes a three-year period for many supporting records, measured from filing or the due date in relevant circumstances. Longer periods can apply, including situations involving substantial omission of income, unfiled returns, or fraudulent returns. Employment tax records generally have separate federal requirements. Organizations should verify current IRS guidance and Colorado Department of Revenue requirements rather than treat three years as a blanket rule.
Employment records also have differing federal timelines. For example, the Equal Employment Opportunity Commission’s recordkeeping rules generally require covered employers to retain specified personnel and employment records for at least one year, with additional rules for payroll records and longer preservation where a charge or action is pending. The Fair Labor Standards Act generally requires payroll records to be kept for three years and certain wage-computation records for two years. Colorado law or a particular dispute may require more.
Health records require particular care. HIPAA requires covered entities and business associates to retain certain documentation related to their HIPAA policies and compliance for six years from creation or the date it was last in effect, whichever is later. That six-year rule is not a universal HIPAA medical-record retention period. State law, professional rules, Medicare or Medicaid participation, and facility requirements may set other periods for patient charts and related records.
Building a Practical Records Retention Policy
A written policy turns separate legal duties into a repeatable process. It should identify record owners, approved storage locations, retention triggers, disposal methods, and procedures for holds. The policy should cover electronic records as well as paper files; emails, collaboration messages, cloud documents, and backups can all contain records that must be retained or preserved.
- Inventory records. List record types, formats, systems, business owners, and whether they contain personal, financial, health, or confidential information.
- Identify governing rules. Check Colorado statutes, federal laws, agency schedules, contracts, licensing rules, and applicable industry requirements. Ask legal counsel or a records officer to resolve conflicts.
- Set a defensible retention period. Record the authority and trigger for each period, such as the end of a tax year, separation from employment, contract closeout, or final payment.
- Apply holds. Suspend routine deletion when litigation, a government investigation, an audit, a subpoena, or another preservation duty is reasonably anticipated or underway.
- Control access and storage. Limit access to authorized personnel, protect sensitive records, and maintain reliable retrieval and backup practices.
- Dispose securely. Use shredding, pulping, or another effective method for paper and secure erasure or destruction for electronic media, consistent with applicable law and policy.
- Document the process. Keep the approved schedule, hold notices, destruction approvals, and disposal logs where appropriate.
Legal Holds and Exceptions to Routine Destruction
A records schedule does not authorize destruction when another duty requires preservation. A legal hold is a direction to suspend ordinary deletion for records that may be relevant to a lawsuit or reasonably anticipated litigation. Similar preservation duties can arise from subpoenas, regulatory inquiries, audits, or public-records requests.
Once a hold is issued, the organization should identify custodians and systems, communicate the scope, suspend relevant automatic deletion, and confirm that staff understand their responsibilities. Backups and archived data may require special consideration. A hold should be reviewed periodically and released only by an authorized person after the preservation duty ends.
Destroying records after a preservation duty arises can create serious consequences, including court sanctions or adverse inferences. Conversely, keeping every record indefinitely can increase privacy, security, and discovery risks. A consistent policy helps balance lawful retention with timely, secure disposal.
Electronic Records, Email, and Secure Disposal
Colorado records are not limited to paper. An electronic record may include email, text messages, spreadsheets, databases, scanned documents, social media content, or information stored in a cloud service. For public agencies, the record’s content and government-business context can matter more than the device or account used to create it. Agencies should follow applicable policies for official communications and preservation.
Deleting a file from a desktop or inbox may not remove every copy. Records can remain in shared drives, cloud platforms, mobile devices, archives, and backup systems. Organizations should coordinate retention settings with information technology staff and vendors, and should confirm that routine deletion does not erase records subject to a legal hold.
For personal identifying information, Colorado’s secure-disposal requirements make disposal method important. Paper containing sensitive information should be rendered unreadable, and electronic media should be sanitized or destroyed using a method appropriate to the data and device. Simply placing documents in ordinary trash or deleting a visible file may not adequately protect the information.
Common Compliance Mistakes
- Using one retention period for every record. Different laws and business purposes create different timelines.
- Confusing access with retention. CORA governs public access; records schedules and other laws govern preservation and disposal.
- Ignoring the start date. A retention clock may begin at filing, payment, contract completion, employee separation, or another defined event.
- Deleting records during a hold. Routine destruction must stop for potentially relevant records when preservation duties apply.
- Keeping sensitive data indefinitely. Unnecessary retention can increase the impact of a breach and may conflict with privacy obligations.
- Overlooking electronic copies. Email, cloud storage, messaging apps, and backups may contain records that are not included in a paper-file process.
Official Resources for Colorado Records Compliance
Organizations should verify current requirements using authoritative sources. The Colorado State Archives Records Management Program provides public-sector records guidance and schedules. The Colorado General Assembly publishes Colorado statutes, including Title 24, Article 80; CORA provisions in Title 24, Article 72; and personal-information laws in Title 6. Federal requirements can be checked through the IRS recordkeeping guidance, the U.S. Department of Labor FLSA recordkeeping fact sheet, the EEOC recordkeeping requirements, and the HHS HIPAA resources.
Because retention duties can change and overlap, organizations should confirm the rules that apply to their records with qualified legal, compliance, or records-management professionals. This is particularly important before destroying public records, health information, employment files, or records connected to a dispute or investigation.