Dispensary Record Retention Benchmarks 2026

California cannabis regulations generally require specified business records to be kept for 7 years, while federal employment tax records are kept for at least 4 years and OSHA injury and illness records for 5 years [S1][S2][S3]. The different periods answer the title directly: a dispensary needs a record-class schedule, not one universal deletion date.

The direct 2026 benchmark

A defensible benchmark is “retain for the longest applicable period, measured from the correct trigger, unless a legal hold or other documented duty requires longer.” The number changes with jurisdiction, license, record purpose, worker status, event, and pending dispute.

The table below provides sourced starting points for common classes. It is not a complete legal schedule and should be validated for the operator’s states, localities, contracts, insurers, litigation profile, and actual systems.

For operational context on the regulated inventory trail, read the METRC inventory control guide. Inventory retention and inventory accuracy are related but distinct controls.

Screenshot-ready retention benchmark table

Every number in the table belongs to a specific authority and trigger. The 3-year Form I-9 date is not always the destruction date because the 1-year-after-termination branch can end later [S5].

The FLSA rows demonstrate why “keep payroll for 3 years” is incomplete. Supporting wage calculations can carry a 2-year federal minimum, while tax, state wage, contract, audit, claim, or hold requirements may extend the working schedule [S2][S4].

Cannabis license records

California’s Department of Cannabis Control requires licensees to maintain enumerated records for at least 7 years [S1]. The regulation covers business records such as financial, personnel, training, contracts, permits, security, destruction, and inventory-related material within its defined scope.

That period should not be copied into a Virginia schedule as if it were national law. It is useful as a cross-jurisdiction benchmark and as proof that long cannabis-specific periods exist.

Colorado’s marijuana rules generally use 3 years for required books and records unless another provision states a longer period [S7]. The difference between 7 and 3 years is not an inconsistency to average; it is a jurisdiction distinction.

Virginia medical cannabis operators must consult the current CCA rules, license conditions, and applicable healthcare, pharmacy, tax, and employment authorities [S8]. A service provider’s default folder policy cannot override those sources.

METRC or another seed-to-sale platform should not be treated as the only archive without verifying export access and regulatory requirements. System availability, audit evidence, and legal retention are different questions.

Tax and financial records

The IRS says employment tax records should be kept for at least 4 years after the tax becomes due or is paid, whichever is later [S2]. This trigger requires both dates, not simply the calendar year printed on a folder.

Income-tax support depends on the applicable limitation period and the facts. IRS Publication 583 describes records businesses should retain and points to the periods of limitations rather than prescribing one number for every document [S9].

Source invoices, daily sales, cash logs, bank statements, processor statements, returns, and general-ledger entries may participate in the same transaction chain. Deleting one link early can make the retained summary impossible to substantiate.

A tax retention class should identify the return, entity, jurisdiction, period, filing date, payment date, amendment status, and supporting schedules. It should also identify which copy is authoritative when the accounting platform and document repository both hold a version.

Section 280E can affect cannabis tax treatment under current federal law, but it does not create one simple document period. The IRS marijuana-industry page explains federal tax obligations and should be checked for current agency guidance [S10].

Employment and hiring records

The Department of Labor requires covered employers to preserve payroll records for at least 3 years and certain wage-calculation records for 2 years [S4]. Job descriptions, pay-rate changes, schedules, additions, deductions, and time records should be mapped to the precise rule and business purpose.

USCIS uses a calculated Form I-9 rule: 3 years after hire or 1 year after termination, whichever is later [S5]. A retention tool should calculate both candidate dates and select the later one.

For example, if employment ends quickly, the hire-date branch may control. If employment lasts many years, the termination branch may control; this explanation follows the official formula and does not add a new fixed period.

EEOC regulations generally require covered private employers to preserve personnel or employment records for 1 year, with special rules for involuntary termination and pending charges [S6]. Federal contractors, educational institutions, state rules, and other laws can impose different obligations.

Recruiting files should separate applicant materials, interview notes, accommodation records, background-check records, and employee personnel files. Access restrictions may differ even when disposition dates coincide.

Safety and incident evidence

Covered OSHA establishments retain Forms 300, 300A, and 301 for 5 years following the end of the calendar year covered [S3]. OSHA also requires updates to certain logs during that retention period, so archival integrity does not always mean freezing every field.

Incident files may include video, witness statements, photographs, insurer communications, corrective actions, and workers’ compensation records. The OSHA form period does not automatically decide each related item’s date.

Security video often has a much shorter technical overwrite cycle than a formal incident file. When an event occurs, authorized staff need a preservation process that copies relevant footage into a controlled case without changing the original context.

Do not preserve all surveillance indefinitely as a substitute for triage. Excess retention increases privacy, access, breach, and discovery exposure while making relevant evidence harder to find.

Customer, patient, and privacy-sensitive records

A dispensary should minimize personal data that is not required for a defined purpose. NIST’s Privacy Framework describes identify, govern, control, communicate, and protect functions that can structure privacy risk work, but it does not impose a cannabis retention period [S11].

Medical-program status does not mean every dispensary record is governed by HIPAA. Entity status, transaction, data flow, and state law determine applicability, so a generic “medical equals HIPAA” label is unsafe.

Separate identity verification, purchase history, loyalty data, marketing consent, service messages, and incident records. Each has a different purpose, access group, and deletion trigger.

When data is de-identified or aggregated, document the transformation and remaining re-identification risk. Merely removing a customer name may not make a detailed transaction history anonymous.

Designing the retention schedule

Create one row per record class, not one row per software application. An application often contains records with several legal and operational purposes.

Recommended fields are record-class ID, description, owner, jurisdiction, authority, minimum period, trigger event, trigger source, calculated disposition date, authoritative copy, storage system, access group, legal-hold status, and disposition method. This is an editorial schedule design.

Use event-based triggers precisely. “Termination date,” “tax paid date,” “calendar year end,” “license expiration,” “contract end,” and “case closure” produce different calculations.

If two authorities apply, retain the authority mapping and use the later valid date. Do not erase the shorter requirement, because it explains why the class was retained in the first place.

For help documenting repositories and approved workflows, see workflow documentation support. Legal interpretation, hold issuance, and destruction approval should remain with authorized owners and counsel.

Legal holds and disposition

A legal hold suspends ordinary destruction for records within its defined scope. It should identify custodians, systems, date range, subject matter, issuing authority, acknowledgment, and release process.

The hold flag must override automated deletion. A monthly deletion job that checks only the scheduled date can destroy preserved material if the hold table is disconnected.

Disposition should produce evidence: record class, eligible date, hold check, volume, method, approver, execution time, exceptions, and vendor certificate where relevant. The certificate does not prove every copy was deleted unless the scope and systems support that conclusion.

Backups complicate deletion. A policy may allow records to age out through a documented backup rotation rather than surgically editing immutable media, subject to applicable law and restoration controls.

Retention performance statistics

Schedule coverage rate can be calculated as active repositories mapped to approved record classes / active repositories inventoried x 100. This is an original calculation, not an industry target.

Disposition timeliness can be calculated as eligible, hold-free batches disposed within the approved window / eligible, hold-free batches x 100. The organization must define its approved window as an editorial policy and not misstate it as law.

Hold acknowledgment rate and overdue review count can identify workflow breakdowns. They do not prove that preservation is complete because undiscovered repositories may remain outside the denominator.

Track exceptions by cause: missing trigger, disputed owner, inaccessible archive, unresolved hold, failed deletion, vendor delay, or authority conflict. A single overdue total does not tell managers what to fix.

Methodology and limitations

We reviewed 12 sources last verified July 23, 2026. We prioritized regulator text and agency instructions that state a period or calculation, then used records-management and privacy frameworks for control design.

The table reproduces specific public minimums and keeps their triggers visible. We did not select the longest number and declare it universal.

The proposed performance rates and schedule fields are labeled editorial methods. They are not legal requirements or observed industry averages.

Limitations

This is not a fifty-state legal survey. Local rules, license conditions, contracts, insurance policies, tax circumstances, litigation, and record content can change the applicable period.

Web guidance can lag statutory or regulatory amendments. Validate citations with current controlling text before approving a schedule or destruction batch.

A minimum is not always the final date. Holds, audits, investigations, claims, minors, amended returns, or contract duties may extend retention.

Longer is not automatically safer. Over-retention creates privacy, security, cost, and discovery consequences that must be weighed by qualified decision-makers.

Frequently asked questions

How long should a dispensary keep all records?

There is no one period for all records. This comparison ranges from 1 year for many EEOC personnel records to 7 years for California cannabis business records, with different triggers and exceptions [S1][S6].

Is seven years the safest default?

Not automatically. 7 years is a sourced California cannabis period, not a universal rule, and unnecessary retention can create risk [S1].

When can Form I-9 be destroyed?

Calculate 3 years after hire and 1 year after employment ends, then use the later date [S5]. Check for holds or other requirements before destruction.

Does keeping data in METRC satisfy retention duties?

Not necessarily. Verify the applicable rule, platform availability, export requirements, and whether related source documents must also be retained.

What happens when a legal hold arrives?

Suspend routine destruction for the defined scope, notify custodians, preserve relevant systems, document acknowledgment, and wait for authorized release.

Sources

1. [S1] California Department of Cannabis Control, Medicinal and Adult Use Cannabis Regulations, §15037, General Record Retention Requirements, revised January 1, 2026.
2. [S2] IRS, Employment Tax Recordkeeping, updated April 29, 2025.
3. [S3] OSHA, Injury and Illness Recordkeeping and Reporting Requirements, accessed July 23, 2026.
4. [S4] US Department of Labor, Fact Sheet 21: Recordkeeping Requirements under the FLSA, revised July 2008.
5. [S5] USCIS, Handbook for Employers M-274, 10.0 Retaining Form I-9, reviewed July 18, 2023.
6. [S6] EEOC, 29 CFR Part 1602 Recordkeeping Requirements, accessed July 23, 2026.
7. [S7] Colorado Marijuana Enforcement Division, 1 CCR 212-3, Books and Records, rules effective January 8, 2024.
8. [S8] Virginia Cannabis Control Authority, Laws and Regulations, updated July 1, 2026.
9. [S9] IRS Publication 583, Starting a Business and Keeping Records, revised January 2025.
10. [S10] IRS, Marijuana Industry, updated June 26, 2025.
11. [S11] NIST, Privacy Framework 1.0, published January 16, 2020.
12. [S12] National Archives, Records Management, updated September 12, 2024.

Conclusion

A publishable retention benchmark keeps the rule and trigger together: 7 years for cited California cannabis records, 4 years for federal employment tax records, and 5 years for covered OSHA forms [S1-S3]. If your team needs a source-linked schedule prepared for legal review, book a free consultation call.