How Long to Keep Business Records in Canada: CRA 6-Year Rule

Last updated October 2026. Added a quick-reference table and answers on the seven-year question, invoices and receipts, scanned records, and self-employed record keeping.

Quick Reference: How Long to Keep Each Record

Record	Keep for	Rule
Tax returns, invoices, receipts, bank statements, ledgers	6 years	CRA: from the end of the last tax year they relate to
GST/HST records	6 years	CRA: same six-year rule
Payroll records	6 years	CRA (Ontario employment rules also apply below)
Records for a return filed late	6 years from the date you file	CRA
Records under objection or appeal	Until it is resolved and any further appeal period has passed, or 6 years, whichever is later	CRA
Long-term property, share register, wind-up of the business	Indefinitely	CRA
Employee hours, wages, overtime	3 years	Ontario Employment Standards Act
Vacation time and pay	5 years	Ontario Employment Standards Act
Minute book, articles, by-laws, share register	Permanently	Federal and Ontario corporate statutes
Customer personal information	Only as long as needed for its purpose	PIPEDA (no fixed period)
Physician records, adult patients (Ontario)	10 years after the last entry	CPSO policy

The six years run from the end of the tax year the record relates to, not from the date on the document. A January 2026 invoice belongs to the 2026 tax year, so for a calendar year-end business it is kept until the end of 2032. That is where the "seven-year rule" people mention comes from.

Records retention is the unglamorous side of compliance. Most Ontario businesses keep records far longer than the law requires, which creates exposure (more data to lose in a breach), cost (storage and management), and PIPEDA compliance risk (PIPEDA requires limiting retention to what is necessary). This guide covers the actual retention requirements for the common record categories and how to build a defensible schedule.

Want a one-page version to share with your team?

Our printable Ontario Records Retention Schedule lists every period on this page with its source. Use it as the starting template for your own policy.

Open the Ontario Records Retention Schedule

Why Retention Matters Both Ways

Retention is a two-sided problem. Keep records too short and you violate statutory requirements (tax law, employment standards, industry regulations). Keep them too long and you violate privacy law that requires limiting retention, plus you carry unnecessary risk if you suffer a breach.

The Office of the Privacy Commissioner of Canada has been increasingly explicit that "we kept it because storage is cheap" is not a defensible answer under PIPEDA. Personal information must be retained only as long as necessary to fulfill the purpose for which it was collected, then destroyed, erased, or anonymized.

Tax and Corporate Records

The Canada Revenue Agency requires businesses to keep records for at least six years from the end of the last tax year they relate to. This covers accounting records, general ledger, supporting source documents, payroll records, and the documents needed to verify tax positions.

Permanent record categories under the federal and Ontario corporate statutes include articles of incorporation and amendments, by-laws, minutes of shareholder and director meetings, share registers, and registers of directors and officers. Permanent means permanent: these survive the life of the corporation.

Practical retention schedule:

Tax returns and supporting documents: 6 years after the relevant tax year
Sales tax records: 6 years
Payroll records: 6 years (CRA), but employment standards reach further (see below)
Corporate records (minute book, share register): permanent
Major contracts: contract term plus 6 years for tax purposes, plus limitations period (2 years in Ontario) for disputes

Employment Records

Ontario's Employment Standards Act requires employers to retain specific records for three years after they were made. This includes hours worked, wages paid, vacation accrual, public holiday pay, and overtime calculations. Workplace Safety and Insurance Board (WSIB) records have longer retention requirements.

Hiring records (applications, resumes, interview notes, offer letters) are typically retained for one to three years for unsuccessful candidates, longer for hires (often keeping the offer letter and signed employment agreement for the duration of employment plus the limitations period after termination).

Discipline and performance records are usually kept for the duration of employment plus the limitations period for wrongful dismissal claims (two years in Ontario). Sensitive records (medical accommodations, drug and alcohol assessments) have specific privacy protections and shorter retention.

Customer Records and PIPEDA

PIPEDA does not specify retention periods. It requires that personal information be retained only as long as necessary to fulfill the purposes for which it was collected, then destroyed, erased, or anonymized in a manner that prevents reconstruction.

For customer records, the practical question is "what is the necessary purpose and when does it end." The relevant durations:

Active customer relationship: necessary for as long as the relationship is active
Post-relationship: necessary for the limitations period for any disputes (2 years in Ontario for most contract disputes, longer for some claims)
Tax purposes: 6 years after the relevant tax year if the records support tax positions
Marketing consent: until the consent is withdrawn

A defensible default for customer records is the relationship duration plus seven years. After seven years post-relationship-end, the records should be destroyed, anonymized, or transferred to a long-term archive with documented retention justification. For the underlying PIPEDA requirements, see our PIPEDA compliance checklist.

Industry-Specific Retention

Some industries have specific record retention rules that override the defaults.

Healthcare in Ontario operates under PHIPA. Patient records are generally retained for 10 years after the last entry or until the patient turns 28, whichever is later. Specific subsets (consent, advance directives) have permanent retention. We cover this in our piece on PHIPA IT requirements.

Legal firms retain client files for at least 15 years after the last billing or representation activity per Law Society of Ontario expectations, with permanent retention for certain document types like wills and corporate records.

Financial services firms (investment advisors, dealers) have specific retention requirements from CIRO (formerly IIROC) typically running 7 years post account closure, plus client onboarding records.

Construction firms retain project records for the duration of the Construction Act limitation period (which can extend years past project completion) plus the tax retention period.

Get the one-page Ontario retention schedule

Every period on this page, on a single printable sheet with its primary source cited, so you can hand it to your team and defend it. We will email it to you.

No spam. The resource plus the occasional Ontario compliance update. Unsubscribe anytime.

Building a Retention Schedule

A defensible retention schedule covers four columns:

Record category: What the records contain (customer master, payroll, project files, etc.)
Retention period: How long they are kept, in years or by event trigger
Justification: Statute, regulation, contract, or business need that drives the retention
Disposition: What happens when retention ends (destroy, anonymize, archive)

Schedules typically end up with twenty to forty categories for a mid-size business. Once approved by leadership, the schedule needs to be reflected in actual systems: labels on file shares, retention policies in Microsoft 365 or Google Workspace, purge cadence in line-of-business apps, and physical destruction procedures for paper.

Storage and Disposal

Storage matters because over-retention is a real risk under PIPEDA. The cleanest approach is automated lifecycle policies that move active records to short-term storage, archived records to long-term storage, and trigger destruction at the retention horizon. Microsoft 365 retention labels handle this well for the documents that live in M365, and setting up retention policies is part of our Microsoft 365 management. For SharePoint storage specifically, see SharePoint archiving.

Disposal must be effective. Deleting a file from a file share does not destroy it for privacy purposes if it remains recoverable in backups indefinitely. The schedule should include backup expiry that aligns with the retention horizon, not exceeds it by years. Physical disposal of paper records and old media should use a documented destruction service with certificates.

One structural fix worth knowing about: if your records live across spreadsheets and shared drives, nothing enforces the schedule, and every deletion depends on somebody remembering. A system built around your own categories can carry the retention rule on each record and enforce disposition automatically; that is the kind of workflow a custom system from ClayGen is shaped for.

For the broader compliance picture covering PIPEDA, PHIPA, SOC 2, breach notification, and how retention fits with each, see our compliance guide for Ontario businesses.

Need help putting a retention schedule into practice?

Setting up retention policies in Microsoft 365 is part of our Microsoft 365 management. Tell us what you keep today and we will talk through where to start. Free consultation, no obligation.

Talk to ClayGen about retention Get the retention schedule

Records Retention FAQ

How long do you have to keep business records in Canada?

Six years from the end of the last tax year the records relate to, under Canada Revenue Agency rules. This covers tax returns, invoices, receipts, bank statements, ledgers, GST/HST, and payroll records. Some records must be kept longer: records tied to long-term property or the wind-up of the business indefinitely, corporate minute books and share registers permanently, and records under a tax objection or appeal until it is resolved.

What records do you need to keep for 7 years in Canada?

No Canadian tax rule says seven years. The CRA rule is six years from the end of the tax year a record relates to, which in practice means up to seven calendar years from the date on the document. That is why many businesses use a seven-year rule of thumb for tax, accounting, payroll, and GST/HST records.

How long should a business keep invoices and receipts?

Keep sales invoices, purchase receipts, and other supporting documents for six years from the end of the tax year they relate to. They back up the income and expenses on your return, so the CRA can ask to see them in an audit. Electronic copies are fine as long as they are complete and readable.

Can I scan paper records and throw away the originals?

Generally yes, if the scans are complete, legible, and stored reliably, following the CRA guidance on imaging paper records. Records that were created electronically, such as emailed invoices or accounting software files, must be kept in electronic form. Keep backups, because a lost hard drive does not extend the deadline.

How long do self-employed people in Ontario keep records?

The same six-year CRA rule applies to sole proprietors and the self-employed: keep income and expense records, receipts, invoices, and bank statements for six years from the end of the tax year they relate to. If you have employees, Ontario employment standards records apply as well.

How long do you have to keep business records in Ontario?

The Canada Revenue Agency requires most business records to be kept for six years from the end of the last tax year they relate to. Some categories run longer: Ontario employment records are kept for three years (vacation records five years), corporate minute books are permanent, and regulated sectors like healthcare and legal have their own longer periods.

How long does the CRA require tax records to be kept?

The CRA requires records and supporting documents to be kept for six years from the end of the last tax year they relate to. Records tied to long-term property, the share register, or the wind-up of a business must be kept indefinitely. You need CRA permission to destroy records before the six-year period ends.

How long must Ontario employment records be kept?

Under Ontario's Employment Standards Act, most employee records (hours worked, wages, public holiday and overtime calculations) are kept for three years. Vacation time and pay records are kept for five years. WSIB and discipline records can run longer, often the duration of employment plus the two-year limitations period.

Does PIPEDA set a records retention period?

No. PIPEDA does not specify retention periods. It requires that personal information be retained only as long as necessary to fulfill the purpose it was collected for, then destroyed, erased, or anonymized. Keeping data longer than necessary is itself a PIPEDA compliance risk, not just a storage cost.

How long are healthcare records kept under PHIPA in Ontario?

Under PHIPA and College of Physicians and Surgeons of Ontario guidance, adult patient records are kept for ten years from the last entry. For minors, records are kept until ten years after the patient turned or would have turned eighteen. The CPSO recommends fifteen years overall because of the Limitations Act.

Can we destroy business records after 7 years?

Usually, but check the category first. The CRA baseline is six years from the end of the last tax year the records relate to, which is why many businesses round to a seven-year rule of thumb (the year the record was created plus six). Some records must never be destroyed: corporate minute books, share registers, and documents tied to long-term property or the wind-up of a business. Destroying early requires CRA permission, and destruction should follow your written schedule and be documented.

What does a records retention schedule include?

A defensible retention schedule lists four things for each record category: the record type, the retention period (in years or by event trigger), the justification (statute, regulation, contract, or business need), and the disposition when retention ends (destroy, anonymize, or archive). Most mid-size businesses end up with twenty to forty categories.

How Long to Keep Business Records in Canada (2026): CRA, Ontario Employment, and PIPEDA Rules