Proper data retention and secure storage protect the records generated during testing long after the appointment ends; this guide covers the standards safeguarding your lie detector test results.
A comprehensive resource covering the American Polygraph Association's minimum retention requirements under Standards of Practice Section 1.7.9.1, encrypted storage best practices including AES-256, access control protocols, lawful disposal procedures, and the legal frameworks every examiner must follow to protect examination integrity and examinee privacy.
TL;DR — The Short Version
- APA Standards of Practice Section 1.7.9.1 mandates that all polygraph examination records—reports, test questions, data, recordings, and documents—be retained for a minimum of three years or as required by law.
- Audio and video recordings carry a separate one-year minimum retention requirement under APA Standards Section 1.7.9.2, though best practice is to retain them for the full three-year period.
- The Employee Polygraph Protection Act (EPPA) independently requires both employers and examiners to retain polygraph records for a minimum of three years from the date the examination is conducted.
- AES-256 encryption is the current best practice for securing digital polygraph data—it is the same standard approved by the NSA for protecting TOP SECRET government information.
- State licensing laws, PCSOT program requirements, and jurisdictional regulations may impose retention periods longer than the APA minimum—examiners must know their local requirements.
- Digital records should follow the 3-2-1 backup rule: three copies, on two different media types, with one offsite backup.
- Secure disposal after retention periods requires certified methods such as cross-cut shredding for physical records or NIST SP 800-88 compliant digital sanitization.
Who This Guide Is For
- Licensed polygraph examiners seeking to align their practice with APA standards
- New polygraph examiner trainees learning record-keeping requirements
- Polygraph agency owners and practice managers responsible for compliance oversight
- Attorneys and legal professionals who need to understand record availability for court proceedings
- Law enforcement agencies that conduct or commission polygraph examinations
- PCSOT examiners with additional retention requirements from supervising agencies
- Quality control reviewers and peer review examiners
Overview of APA Minimum Storage Requirements
The Three-Year Retention Standard
The American Polygraph Association (APA), established in 1966 with approximately 2,800 members Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention. The current Standards of Practice were most recently amended on August 23, 2024 Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention. Best practice, however, is to retain recordings for the full three-year period alongside other examination records to maintain a complete evidentiary package.
What 'All Examination Records' Actually Means
The APA's retention requirement is deliberately comprehensive. When the standards reference all examination records, they encompass every piece of documentation generated during or related to the examination process. This includes:
Physiological data charts — the raw polygraph tracings from all channels including thoracic and abdominal respiration (pneumograph), cardiovascular activity (cardio cuff), electrodermal activity (EDA), and any supplemental measures such as a seat activity sensor Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention, and the specific question wording must be preserved verbatim for any future review.
Scoring sheets and analysis documentation — numerical scores, decision rules applied, and any algorithmic analysis outputs. Methods such as the Empirical Scoring System (ESS), validated across 732 confirmed examinations scored by 140 examiners in 16 cohorts Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention.
An examiner who retains only the final report but discards the underlying physiological data has not met the APA standard. The entire chain of evidence must be preserved so a qualified third-party reviewer could independently evaluate the examination. This principle is directly supported by research demonstrating that trained examiners achieve significantly higher accuracy than untrained raters when interpreting polygraph charts Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention.
Records also serve as a form of professional insurance. Comprehensive documentation provides the examiner with a defensible paper trail if questions arise about how data was handled. For examiners aspiring to maintain their continuing education requirements, well-organized records demonstrate diligence during membership reviews.
Key Elements of Polygraph Data Retention
Physiological Data: The Foundation of Every Examination
Physiological data forms the scientific core of every polygraph examination. Under APA Standards of Practice, instruments must continuously record thoracic and abdominal respiration patterns separately using two pneumograph components, electrodermal activity reflecting relative changes in conductance or resistance, and a cardiograph component reporting pulse rate, pulse amplitude, and relative blood pressure changes Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention. While the minimum retention for recordings under Section 1.7.9.2 is one year Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention, retaining them for the full three-year general retention period is strongly recommended.
Recordings are particularly important for documenting the informed consent process, where the examiner explains the procedure and the examinee voluntarily agrees to participate Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention. They also capture the pretest interview—where test questions are reviewed and discussed—and any post-test interview where admissions may be made.
For PCSOT examiners, the APA's Model Policy for Post-Conviction Sex Offender Testing (September 2021) specifically states that examiners should record all PCSOT polygraph examinations from the beginning of the pretest interview to the completion of the post-test review, with the recording retained for a minimum of three years or as required by local laws Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention. Another examiner reviewing the case needs to see the exact wording used, as question construction directly affects validity. The test data sheet should comprehensively document all of these elements.
Best Practices for Digital Data Security
Encryption Standards for Polygraph Data
In an era where nearly all polygraph data is generated and stored digitally, data security is inseparable from data retention. The current industry best practice is AES-256 (Advanced Encryption Standard with 256-bit keys). AES was developed by NIST beginning in 1997 and is based on the Rijndael cipher Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention means that quality control records serve a dual purpose: they demonstrate both individual examiner diligence and adherence to the profession's scientific standards.
Peer Review: Accountability Through Documentation
Peer review adds an additional layer of accountability. The PCSOT Model Policy recommends that an independent quality control peer review of a portion of each examiner's work product take place annually Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention—requirements documented in detail in our guide to APA time limits and best practices.
State Licensing Laws and Extended Retention
Polygraph licensing requirements vary significantly from state to state Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention. Audio/video recordings have a separate minimum of one year under Section 1.7.9.2 Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention, though retaining them for the full three years is strongly recommended.
Does the three-year retention period also apply under federal law?
Yes. The Employee Polygraph Protection Act (EPPA) independently requires both employers and polygraph examiners to retain required records for a minimum of three years from the date the polygraph examination is conducted, or from the date it was requested if no examination occurred Verified APA Standards of Practice (via Global Polygraph Network)
Confirms APA Standards Section 1.7.9.1 three-year minimum retention and Section 1.7.9.2 one-year recording retention. All physiological channels—pneumograph, cardiograph, EDA, and seat activity sensor—must be recorded [3]Verified APA Standards of Practice (Amended 8-23-24)
Confirms APA instrument requirements including pneumograph, cardiograph, EDA, and seat activity sensor.
Is cloud storage acceptable for polygraph records?
Cloud storage is acceptable when properly configured with end-to-end encryption (AES-256), SOC 2 Type II compliance, multi-factor authentication, detailed access logging, and appropriate data residency controls. Consumer-grade cloud services without additional encryption measures do not meet the expected standard of care. HIPAA-compliant cloud options should be used when examinations involve health-related information.
How does Canada handle polygraph data retention?
Canada's Privacy Act requires government institutions to retain personal information used for administrative purposes for at least two years [23]Verified Canadian Privacy Act Retention and Disposal Guidelines (TBS)
Confirms two-year minimum retention for personal information under Canadian federal Privacy Act. PIPEDA requires that personal information no longer needed be destroyed [24]Verified PIPEDA Fair Information Principle 5 – Limiting Use, Disclosure, and Retention
Confirms PIPEDA requires personal information no longer needed to be destroyed with guidelines for disposal. While Canadian courts have ruled polygraph results inadmissible in criminal trials [25]Verified Federal Government Rethinking Use of Polygraph Test (CBC News)
Confirms Canadian use of polygraphs for Enhanced Top Secret clearances and Supreme Court of Canada ruling on inadmissibility, the Canadian government uses polygraphs for security screening in agencies like CSIS and CSE [25]Verified Federal Government Rethinking Use of Polygraph Test (CBC News)
Confirms Canadian use of polygraphs for Enhanced Top Secret clearances and Supreme Court of Canada ruling on inadmissibility. Canadian privacy regulations impose specific obligations regarding collection, use, disclosure, storage, and retention of polygraph data [26]Verified Measures to Anonymize Polygraph Records – OPC Investigation
Documents 2025 OPC investigation into NSIRA access to polygraph examination recordings at CSE.
What is the role of hash verification in protecting polygraph records?
SHA-256 hash verification generates a unique digital fingerprint for each file at the time of creation. Any subsequent modification to the file changes the hash value, immediately revealing tampering [14]Verified SHA-256 Hash Values in Digital Forensics
Confirms SHA-256 produces a 256-bit hash that is the current industry standard in digital forensics. SHA-256 is the current industry standard in digital forensics, producing a 256-bit hash that is highly secure and widely accepted in legal contexts [14]Verified SHA-256 Hash Values in Digital Forensics
Confirms SHA-256 produces a 256-bit hash that is the current industry standard in digital forensics. Examiners should generate and store hash values for all examination files as part of their chain-of-custody documentation.
Sources & References
Confirms APA was established in 1966 with approximately 2,800 members
Confirms APA instrument requirements including pneumograph, cardiograph, EDA, and seat activity sensor
Introduced ESS scoring system validated across 732 confirmed examinations by 140 examiners in 16 cohorts
Confirmed that trained examiners achieved significantly higher accuracy than untrained raters
Applied behavioral science concepts of reliability and validity to polygraph admissibility questions
Found computerized evaluations achieved accuracy of at least 90%, equaling or exceeding human scorers
Confirms state-level polygraph instrument requirements and documentation retention under law enforcement records schedules
Confirms PCSOT recording retention minimum of three years and annual quality control peer review requirement
Found ESS component weighting achieved superior diagnostic extraction compared to simpler three-position scoring models
Confirms AES-256 approved for TOP SECRET information and is considered quantum resistant
Confirms AES-256 is used by government, military, finance, and healthcare for protecting sensitive data
Confirms EPPA three-year record retention requirement and $50,000 minimum bond/liability coverage
Confirms SHA-256 produces a 256-bit hash that is the current industry standard in digital forensics
DNN-based algorithm outperformed both PolyScore and OSS-3 on test data by accounting for bio-signal nonlinearity
The 2011 APA meta-analysis established mandatory standards requiring only scientifically validated techniques
Developed two-stage scoring approach that reduced inconclusive rates while maintaining decision accuracy
Confirms EPPA three-year record retention from date of examination and recordkeeping requirements for employers and examiners
Confirms EPPA examiner obligations including three-year retention, five-exam daily limit, and $10,000 penalty per violation
Confirms 28 states have polygraph licensing boards and additional PCSOT certification requirements
Confirms EPPA does not preempt more restrictive state or local laws regarding lie detector tests
Confirms two-year minimum retention for personal information under Canadian federal Privacy Act
Confirms PIPEDA requires personal information no longer needed to be destroyed with guidelines for disposal
Confirms Canadian use of polygraphs for Enhanced Top Secret clearances and Supreme Court of Canada ruling on inadmissibility
Documents 2025 OPC investigation into NSIRA access to polygraph examination recordings at CSE
Confirms NIST SP 800-88 has replaced DoD 5220.22-M as primary guidance for media sanitization
Confirms DoD 5220.22-M three-pass overwriting method published in 1995 NISPOM
Confirms DoD 5220.22-M insufficient for SSDs due to flash memory wear-leveling
Confirms California adopted APA standards for PCSOT with records retention amendments
Foundational research on Concealed Information Test later incorporated into APA 2011 meta-analytic review
Demonstrated machine learning integration of EEG, ECG, EOG, eye-gaze, GSR, audio, and video for improved detection