How Should a Small Business Store Records and Control Who Can See Them?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Pick one controlled home for each kind of record, a business cloud account for digital files and a locked cabinet for paper, and organize it by year and type. Then limit sensitive records, like payroll, employee files, and customer payment data, to only the people whose job needs them. Turn on strong logins, back up the digital copies, and remove access the day someone leaves.

What this means

Storage (9.8.3) is where records live. The Internal Revenue Service (IRS) says to keep supporting documents in an orderly fashion and in a safe place, such as by year and type. It also says electronic records must meet the same rules as paper.

Access controls (9.8.4) decide who can open what. The Federal Trade Commission (FTC) tells businesses to give each employee access only to what their job requires, and to remove access quickly when someone leaves or changes roles.

The FTC’s guide for protecting personal information gives five plain steps: know what you have, keep only what you need, lock it, dispose of it properly, and plan for problems. This page covers the “lock it” step.

A simple setup:

Digital records: a business cloud drive owned by a business account, not a personal one. Folders by year and type. A separate restricted folder for sensitive files.
Paper records: a locked cabinet or room. Limited keys. Sensitive papers put back when not in use.
Logins: unique passwords and multi-factor authentication (MFA), which asks for a second proof like a code on your phone (see 11.7.3 Multi-Factor Authentication).
Encryption: turned on for laptops and phones that hold sensitive files.
Backups: a second copy kept apart from the first (see 11.8 Business Backups).

Made-up example: Maple Avenue Dental Lab keeps its business records in a shared drive owned by the company account. Everyone can see the general folders. Only the owner and the office manager can open the payroll and employee folder. Paper I-9 forms sit in a locked cabinet in the owner’s office. When a technician left last spring, the manager removed his drive access that afternoon.

Why it matters

Theft and breaches. Unlocked files and shared passwords are easy targets.
Privacy duties. Employee and customer data often has legal protection, and a breach can trigger notice rules (see 11.6.6 Breach Notification).
Lost records. A single laptop or a personal account is one failure away from losing years of proof.
Losing control. If a former worker owns the account, they own your records.

Who this applies to

Every business. Take extra care if you hold Social Security numbers, bank details, health information, or data about children. Some industries, like health care and finance, have their own storage and security rules. Check with your regulator or licensing board.

How to do it

Pick the home. One business cloud account for digital records, owned by the business (see 12.2 Shared Files).
Build the folders. By year, then by type: taxes, banking, payroll, employees, contracts, insurance, licenses.
Make a restricted folder for sensitive records. Share it only with named people.
Lock paper records. A locking cabinet or room. Track who has keys.
Turn on MFA for every account that holds records.
Use a password manager so logins aren’t shared on sticky notes (see 11.7.2 Password Manager).
Encrypt devices that hold sensitive files. Most phones and laptops have a setting for it.
Set up backups and test them (see 11.8 Business Backups).
Write an access list. Who can open each folder or cabinet, and why (see 11.7.5 Access Inventory).
Remove access the same day someone leaves or changes jobs (see 11.7.7 Removing Access When People Leave).
Review the access list every quarter.

Don’t send sensitive records by regular email. The FTC notes that regular email is not a secure way to send them. Use a secure sharing link with limited access instead.

What proof to keep

Your folder map and storage locations
The access list with names, roles, and dates
Screenshots of MFA turned on for key accounts
Backup test results
A log of access removed when people left

Common mistakes

Using a personal account for business records. If you leave or the account is closed, the records go with it.
One shared login for everyone. You can’t tell who did what or cut off one person.
Sensitive files in the general folder. Payroll and I-9 forms need their own restricted spot.
“Anyone with the link” sharing. Links get forwarded.
Forgetting paper. A locked drive means little if I-9 forms sit in an open tray.
Leaving access on after someone leaves. Do it the same day.

When to get help from a pro

IT security specialist: if you hold large amounts of sensitive data or aren’t sure your setup is safe. Attorney: if you’re in a regulated industry. Questions to ask:

Does my industry have its own rules for storing records?
Is my cloud setup and access list good enough for the data I hold?
What should I do first if a device with records is lost?

Bill’s note

[Bill: add a short lesson. For example, a client who lost access to their Google Business Profile or records because a former employee owned the login, and how it was fixed.]

If you’d rather have this done for you, SiteSmarty sets up business-owned accounts for your website and Google Business Profile.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: where SiteSmarty records live, how folders are set up, and who has access]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the folder structure and the restricted folder sharing settings]
[Result so far:]

Questions people ask

Can I keep business records in the cloud? Yes. The IRS says electronic records follow the same rules as paper. Use a business-owned account with strong logins and backups.

Who should see employee and payroll records? Only the people whose job needs them, usually the owner and whoever runs payroll.

How do I keep paper records safe? Lock them in a cabinet or room, limit the keys, and put sensitive papers back when you’re done.

Do I need to encrypt files? The FTC recommends encrypting sensitive data on laptops, phones, and portable drives. Most devices have this built in.

What do I do when an employee leaves? Remove their access to every account and cabinet that same day, and collect keys and devices.

Audit check

Question: Are records stored in a business-owned, organized location, with sensitive records limited to named people and protected by strong logins?
Pass looks like: Business-owned cloud account and locked paper storage. Folders by year and type. Restricted folder for sensitive files. MFA on. Current access list. Same-day removal when people leave.
Fail looks like: Records in personal accounts or inboxes. Shared logins. Sensitive files open to everyone. Former workers still have access.
Evidence to collect: Folder map, access list, sharing settings screenshots, MFA screenshots, and the access removal log.

Where this fits

Do this first: 9.8.2 Record Retention Periods

Do this next: 9.8.5 Secure Record Destruction

Sources

IRS, "What kind of records should I keep" (checked October 17, 2026)
FTC, "Protecting Personal Information: A Guide for Business" (checked October 17, 2026)
USCIS, "Retaining Form I-9" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.