Retention of background reports is a balancing act: keep the data long enough to defend a decision, but not so long that you expand your breach surface and violate a privacy statute. There is no single federal number that covers every record.
The floor is set by anti-discrimination rules. EEOC regulations generally require employers to keep hiring records, including the basis for decisions, for at least one year, extended if a charge or lawsuit is pending. Federal contractors and certain regulated industries face longer mandates.
State privacy laws now push in the other direction. Frameworks like the CCPA and its successors require that you retain personal information only as long as reasonably necessary for the disclosed purpose, and that you honor deletion requests. Holding a five-year-old rejected applicant's SSN "just in case" is increasingly a liability, not a safeguard.
The workable policy defines a retention window per record type, automates the purge on a fixed cadence rather than leaving it to memory, and logs each deletion. In an audit, a demonstrable, consistently executed schedule is worth more than any single retention length you might pick.