How long must federal agencies keep Privacy Act records and what happens if they over-retain?

There is no single retention period for “Privacy Act records.” Instead, how long an agency keeps records about individuals is governed by records schedules, while the Privacy Act of 1974 sets rules for how those records are maintained, used, and protected.

What sets the retention period

Federal records — including systems of records covered by the Privacy Act — are kept according to approved disposition schedules. These come from two main sources:

• General Records Schedules (GRS) issued by the National Archives, which cover common administrative records found across agencies.
• Agency-specific schedules approved by the National Archives for mission records unique to that agency.

A schedule states whether a record series is temporary (destroyed after a set period or triggering event) or permanent (eventually transferred to the National Archives). The retention period reflects legal, fiscal, operational, and historical needs — not a flat Privacy Act timeline.

The Privacy Act overlay

The Privacy Act layers principles on top of scheduling. Agencies are expected to:

• Maintain only personally identifiable information that is relevant and necessary to a lawful purpose.
• Publish a System of Records Notice describing the records and their retention.
• Keep records accurate, timely, and complete for the purposes for which they are used.

These principles point toward data minimization: collecting and holding only what is needed, for only as long as it is needed.

What happens if an agency over-retains

Over-retention — keeping records past their approved disposition date — creates real risk:

• Larger breach exposure. Every extra record of personal information is additional data that can be lost, stolen, or improperly disclosed.
• Discovery and FOIA burden. Records still in custody generally remain subject to search, review, and potential release.
• Tension with Privacy Act principles. Holding unnecessary information undercuts the relevance, necessity, and accuracy expectations.
• Accountability findings. Inspectors General and oversight bodies frequently flag failure to dispose of records on schedule.

Importantly, agencies generally cannot destroy records simply because they seem outdated; destruction must follow the approved schedule. The compliant path is to apply disposition on time — neither early nor late.

For broader guidance on handling personal information in records programs, see the privacy and PII topic hub.