Document retention requirements in Canada: by industry

Canadian businesses must retain most financial and corporate records for at least 6 years, driven primarily by the Income Tax Act and CRA requirements. However, specific industries face longer retention periods: health records must be kept for 10 years minimum (or longer for minors, depending on the province), and construction records linked to building safety must be preserved for extended periods under provincial building codes. Failing to meet these requirements can result in penalties, regulatory fines and the inability to defend against legal claims. This guide covers the statutory retention periods applicable to Canadian businesses, organized by document type and industry sector.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date. Consult a qualified professional for guidance specific to your situation.

Statutory framework for document retention in Canada

Canada has no single piece of legislation that governs document retention across all sectors. Instead, retention obligations arise from multiple federal and provincial statutes, each covering a specific domain of business activity.

Core legislation

The Limitations Act, 2002 (Ontario) and equivalent provincial limitations legislation set the general limitation period for contractual and tortious claims at 2 years from discovery (with an ultimate limitation period of 15 years in Ontario). Other provinces have varying limitation periods. This creates a practical minimum retention period for most commercial documents, since destroying records before the limitation period expires removes the ability to defend against claims.

The Canada Business Corporations Act (CBCA), section 20 requires every corporation to keep adequate corporate records including articles, by-laws, minutes and securities registers. These must be preserved for the life of the corporation plus 2 years after dissolution.

The CRA requires businesses to keep records that support their tax returns for at least 6 years after the end of the relevant taxation year. Records include invoices, receipts, bank statements, payroll records and GST/HST documentation.

Retention periods by document type

Industry-specific retention requirements

Beyond the general statutory framework, individual sectors face additional obligations imposed by their regulators or sector-specific legislation.

Financial services

OSFI requires federally regulated financial institutions to retain records sufficient to enable regulatory oversight. Under OSFI guidelines, firms must keep records of services and transactions for at least 5 years from the date they were created. For securities-related business, the retention period may extend to 7 years depending on the provincial securities commission requirements.

Anti-money laundering records under the PCMLTFA and FINTRAC guidance must be kept for 5 years after the end of the business relationship or after the date of an occasional transaction. Customer due diligence records, transaction records and suspicious transaction reports all fall within this scope. For more on business verification obligations, see our complete KYB guide.

Healthcare

Provincial health records legislation sets detailed retention periods. In Ontario, the Personal Health Information Protection Act (PHIPA) requires health records to be kept for 10 years after the last entry. For minors, records are generally retained until 10 years after the patient turns 18. British Columbia and Alberta have similar requirements under their respective health information legislation. Mental health records may have extended retention periods depending on the province.

Construction and building safety

Provincial building codes and safety legislation require construction records to be maintained for extended periods. In Ontario, the Ontario Building Code requires building permits and related documents to be retained for the life of the building. Safety inspection records, material specifications and maintenance logs must be preserved according to provincial requirements and project contracts.

Legal profession

Provincial law societies require law firms to keep files for at least 6 years after the matter is concluded. However, best practice recommends longer periods for specific work types: 15 years for real property transactions, 21 years for matters involving minors and indefinitely for wills and trust documents.

Education

Schools and educational institutions must retain student records according to provincial education legislation. In Ontario, the Ontario Student Record must be retained for at least 55 years. Examination results are typically kept for 6 years. Child protection records are retained according to the requirements of provincial child and family services legislation.

Data protection and retention: the PIPEDA balance

PIPEDA and provincial privacy legislation require organizations to keep personal information only for as long as necessary for the purpose it was collected. This principle of storage limitation must be balanced against the statutory retention obligations described above.

Lawful basis for retention

When a statutory obligation requires the retention of documents containing personal information, PIPEDA permits the retention for the legally required period. This means the organization can retain the data for the statutory period without additional consent from the individual.

However, once the statutory retention period expires, the legal basis ceases to exist. The organization must then either destroy the personal information, anonymize it or identify a different lawful basis for continued retention.

Practical implementation

The OPC recommends that organizations implement a retention schedule that maps each category of personal information to its retention period and legal basis. Automated deletion or anonymization processes should trigger at the end of each retention period. Manual processes are acceptable for smaller organizations but increase the risk of non-compliance.

Access controls should ensure that archived records are accessible only to authorized personnel for the specific purposes permitted by law. A payroll record retained for CRA purposes should not be accessible to a marketing team.

Digital retention and electronic records

Canadian law treats electronic records as equivalent to paper records in most circumstances, provided certain conditions are met.

Admissibility of electronic records

The Canada Evidence Act and provincial evidence legislation establish that electronic records are admissible as evidence in legal proceedings. The key requirement is authenticity: the party relying on the record must be able to demonstrate that it has not been tampered with and accurately represents the original.

Metadata, audit trails and digital signatures all strengthen the evidential weight of electronic records. Organizations should ensure their document management systems maintain comprehensive audit logs showing when documents were created, modified, accessed and by whom.

CRA requirements for digital records

The CRA permits businesses to keep electronic records provided they are maintained in a readable format and can be made available upon request. The Electronic Commerce Protection Regulations support the use of electronic records for tax compliance. Digital records must be maintained in a form that allows CRA to access them during an audit.

Building a document retention policy

A retention policy document transforms scattered legal obligations into a structured, operational framework that every department can follow.

Key components

Document inventory. Catalogue every type of document produced or received across the organization. Include physical files, digital records, emails, instant messages and cloud-stored documents.

Retention schedule. Map each document type to its applicable retention period, citing the specific legal basis. Where multiple obligations apply (e.g., a contract that is both a commercial record and contains personal information), apply the longest required period.

Storage and security. Define where documents are stored, who has access and what security measures protect them. Encryption, access controls and backup procedures should be documented.

Disposal procedures. Specify how documents are destroyed at the end of their retention period. Physical documents should be cross-cut shredded. Digital records should be securely wiped using methods that prevent recovery.

For guidance on automating these processes, see our article on automated document verification workflows.

Common retention mistakes and how to avoid them

Keeping everything indefinitely. This is not a safe default. Retaining personal information beyond the required period breaches PIPEDA and exposes the organization to OPC enforcement action.

Applying a single retention period to all documents. Different document types have different legal requirements. A one-size-fits-all approach will inevitably result in some records being destroyed too early and others being kept too long.

Ignoring litigation holds. When litigation is anticipated or underway, normal disposal procedures must be suspended for all documents relevant to the dispute. Destroying documents subject to a litigation hold can constitute spoliation of evidence.

Failing to account for limitation periods. Provincial limitation periods vary (2 years for general claims in Ontario, with a 15-year ultimate limitation). Latent damage claims can extend limitation periods further. Retention periods should account for these variations.

How CheckFile helps manage document retention

CheckFile automates document collection, verification and lifecycle management. Our platform processes over 180,000 documents per month with 98.7% OCR accuracy and a 67% cost reduction compared to manual document management. The platform automatically classifies incoming documents, applies the correct retention period based on document type and industry and triggers alerts before retention deadlines.

Integration with existing document management systems via API means no manual re-entry of data. Visit our pricing page to find the plan that matches your document volume, or request a personalized demo.

For a comprehensive view of document verification processes, see our document verification guide.

For a comprehensive overview, see our document verification complete guide.

Frequently asked questions

How long must Canadian businesses keep tax records?

The CRA requires businesses to retain records supporting their tax returns for at least 6 years after the end of the relevant taxation year. The CRA can extend this period if they notify you in writing or if you have filed an objection or appeal.

Are electronic records legally equivalent to paper records in Canada?

Yes. The Canada Evidence Act and provincial electronic commerce legislation establish that electronic records are admissible as evidence and have equivalent legal standing to paper records. The key requirement is that the organization can demonstrate the authenticity and integrity of the electronic record through audit trails, access controls and appropriate storage.

What happens if a company destroys documents too early?

Destroying documents before the statutory retention period expires can have several consequences. If CRA conducts an audit and records are unavailable, the company may face estimated assessments and penalties. In civil litigation, the court may draw adverse inferences from the destruction of relevant documents. Under PIPEDA, the OPC can investigate whether destruction procedures were applied correctly.

Do retention periods apply to emails?

Yes. Emails are business records and are subject to the same retention requirements as any other document. An email containing a contractual agreement must be retained for the same period as a paper contract. Organizations should implement email archiving solutions that apply retention rules automatically based on content classification, sender/recipient and metadata.

---

The information presented in this article is provided for informational purposes only and does not constitute legal advice. Regulatory obligations vary by province and territory. Consult a legal professional for analysis specific to your situation.

---

Take action

CheckFile verifies 180,000 documents per month with 98.7% OCR accuracy. Test the platform with your own documents — results within 48h.

Request a free pilot