Data Retention Policy (Australia)

An Australian Data Retention Policy is an internal governance document that specifies how an organisation collects, stores, retains, and ultimately destroys or de-identifies personal information and business records. It is not merely a best-practice document — for organisations covered by the Privacy Act 1988 (Cth), a data retention policy is a practical compliance requirement that directly implements the obligations in Australian Privacy Principle 11 (APP 11) relating to the security and destruction of personal information.

The Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) apply to Australian Government agencies, private sector organisations with an annual turnover of more than $3 million, all health service providers, credit reporting bodies, and certain other entities. APP 11.1 requires these organisations to take active measures to protect personal information from misuse, interference, loss, and unauthorised access. APP 11.2 goes further, requiring organisations to take reasonable steps to destroy or permanently de-identify personal information that is no longer needed for any purpose for which it may lawfully be used, and that is not required to be retained by law.

The Notifiable Data Breaches (NDB) scheme, established under Part IIIC of the Privacy Act, requires APP entities to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of an eligible data breach — one likely to result in serious harm — within 30 days. A sound data retention policy directly reduces the organisation's risk under the NDB scheme by ensuring personal information is destroyed when no longer required, minimising the number of individuals who could be affected by a breach.

Australian law also imposes specific statutory minimum retention periods for many categories of records. The Corporations Act 2001 (Cth) requires companies to retain financial records for at least seven years. The Fair Work Act 2009 (Cth) requires employers to retain employee and payroll records for seven years. The Tax Administration Act 1953 (Cth) requires tax records to be kept for five years. The Telecommunications (Interception and Access) Act 1979 (Cth) requires carriers and internet service providers to retain certain telecommunications metadata for two years. A data retention policy must reconcile these mandatory minimum retention periods with the APP 11.2 obligation to destroy personal information when no longer needed.

The Privacy Act reforms currently before the Australian Parliament — implementing recommendations of the 2022 Privacy Act Review — are expected to introduce significant changes, including removal of the small business exemption, enhanced individual rights, a direct right of action, and mandatory privacy impact assessments for high-risk activities. Organisations that establish robust data retention policies now will be better positioned to comply with these reforms when they take effect.

Every organisation that holds personal information about customers, employees, or other individuals in Australia should have a written Data Retention Policy. The policy is particularly critical in the following circumstances.

Any organisation covered by the Privacy Act 1988 (Cth) — including businesses with a turnover exceeding $3 million, all health service providers, and any organisation contracted to the Australian Government — is legally required by APP 11 to take reasonable steps to destroy or de-identify personal information when it is no longer needed. A documented retention policy is strong evidence that the organisation has taken such steps. Without a policy, an organisation may retain personal information indefinitely, which increases both the risk of a data breach and regulatory exposure to the OAIC.

Businesses that handle sensitive personal information — such as health records, financial information, government identifiers, or information about children — face heightened obligations because a breach involving sensitive information is more likely to cause serious harm and therefore more likely to trigger notification obligations under the NDB scheme. A rigorous data retention policy that limits retention to what is strictly necessary directly reduces the scope of exposure.

Employers should adopt a data retention policy to manage employee records in accordance with the Fair Work Act 2009 (Cth), the Privacy Act 1988 (Cth), and state long service leave legislation. Employee records — which typically include payslips, leave records, performance reviews, and disciplinary records — must be retained for seven years under the Fair Work Act, but should generally be destroyed promptly after that period to comply with APP 11.2 and to limit the organisation's liability in the event of a breach.

Companies that engage third-party cloud providers, software-as-a-service (SaaS) platforms, or other data processors must ensure those processors handle and destroy personal information in accordance with the organisation's data retention policy. Under APP 8, an organisation that discloses personal information to an overseas recipient remains accountable for that recipient's compliance with the APPs. Including data retention and destruction requirements in contracts with third-party processors is essential.

Government contractors and entities bidding for government work at federal, state, or territory level must comply with the Privacy Act regardless of their turnover. The Australian Government's procurement guidelines increasingly require suppliers to demonstrate privacy and data governance frameworks, including documented retention policies, as a condition of contract.

A comprehensive Australian Data Retention Policy should include the following key elements to achieve effective legal compliance and operational clarity.

Purpose and Scope — Clearly identify the organisation's name, ABN, and the categories of personal information and business records covered by the policy. The policy should apply to all employees, contractors, and third parties who handle personal information on behalf of the organisation, whether in digital or physical form.

Legal Framework — Reference the specific legislative obligations that underpin the policy, including the Privacy Act 1988 (Cth), the APPs, the Notifiable Data Breaches scheme (Part IIIC), the Corporations Act 2001 (Cth), the Fair Work Act 2009 (Cth), the Tax Administration Act 1953 (Cth), and the Telecommunications (Interception and Access) Act 1979 (Cth). This demonstrates that the retention periods specified in the policy are grounded in law, not arbitrary choices.

Retention Schedule — Specify minimum retention periods for each category of records, aligned with the applicable mandatory minimum periods. The schedule should address employee records (7 years under the Fair Work Act), financial records (7 years under the Corporations Act), tax records (5 years), telecommunications metadata (2 years), contracts (6 years from expiry for simple contracts, 12 years for deeds), and customer and marketing data (as long as commercially necessary and proportionate, then destroy).

Retention Exceptions — Document the circumstances in which personal information must not be destroyed notwithstanding the retention schedule. These include records subject to a legal hold (pending or anticipated litigation, regulatory investigation, or subpoena), records subject to an outstanding access request under the Privacy Act, and records whose retention is required by law or court order.

Approved Destruction and De-identification Methods — Specify the methods that may be used to destroy or de-identify records, with reference to the OAIC's APP guidelines and the ACSC's advice on secure data destruction. For digital records, specify secure overwriting, degaussing, or physical destruction. For paper records, specify cross-cut shredding or incineration by a certified destruction service. The policy should require a destruction log to be maintained.

Notifiable Data Breaches Response — Reference the organisation's data breach response plan and the obligation under Part IIIC of the Privacy Act to notify the OAIC and affected individuals within 30 days of an eligible data breach. Provide the privacy officer's contact details for reporting suspected breaches.

Accountability and Review — Designate a Privacy Officer responsible for administering the policy, maintaining the retention schedule, overseeing destruction activities, and reporting to senior management. Specify a review date (at minimum annually) and commit to updating the policy to reflect changes in law, technology, or business operations.