There is no single retention period in Australia. Each record class has its own minimum, set by the law that applies: tax, employment, corporate, sector or records legislation. Privacy Act APP 11.2 then requires personal information to be destroyed or de-identified once it is no longer needed and no retention obligation applies.
Most organisations keep records for the wrong reasons: fear of deleting something they need, or no one owning the decision. A defensible retention schedule keeps what the law requires and lets you dispose of the rest with confidence.
Why there is no single answer
Australia has no one law that sets how long all records must be kept. Retention periods come from many places: Commonwealth and state legislation, regulators, contracts, and the organisation's own business needs. The same organisation will usually hold records with very different minimums, and the longest applicable requirement for a given record class generally wins.
This is why the useful question is not "how long should we keep records?" but "what is the minimum we must keep for each class of record, and what happens after that?" The answer is written down in a retention and disposal schedule.
The schedule also has to answer a second question: once the minimum has passed, is there still a legal or business reason to keep the record? If not, privacy law expects it to go. A good schedule therefore works as both a keep list and a dispose list.
Where retention requirements come from
Most mid-market organisations deal with several sources at once.
Tax and financial records. Under the Taxation Administration Act 1953 (Cth), business, GST, superannuation and income tax records generally need to be kept for a minimum of five years from the date the relevant tax return is lodged. Personal tax data should not be destroyed early, but it should be securely purged or de-identified once that window closes and no other requirement applies.
Employment records. Under the Fair Work Act 2009 (Cth), detailed employee records such as pay slips, hours worked, leave accruals and employment contracts are generally kept for a minimum of seven years. The Privacy Act has a private-sector employee records exemption for current personnel records, but the seven-year Fair Work period still sets the lawful baseline before deletion. Some state laws add requirements for matters like workers compensation and workplace safety incidents.
Sector laws. Some industries carry specific record-keeping duties. AUSTRAC has set AML/CTF program, customer due diligence and record-keeping obligations for newly regulated sectors, which means significant new collection and retention of identity data [3]. In health, the Share by Default changes to My Health Record from 1 July 2026 require exception records to be kept for two years [4]. In aged care, the new Aged Care Act requires care plans to be reviewed within 12 months, which drives new records and information-handling obligations [2].
Public sector records laws. Commonwealth, state and territory agencies must follow their records legislation, such as the Archives Act 1983 (Cth) or state equivalents, and the retention and disposal authorities issued under it. Public records cannot be destroyed without authorisation, and some must be preserved permanently. At the Commonwealth level this includes general authorities such as the National Archives of Australia's AFDA Express Version 2.
This is a summary, not legal advice. The exact period for your records depends on your sector, jurisdiction and the type of record, so confirm each requirement for your situation.
The other side: you must not keep personal information forever
Retention is not only about keeping records long enough. Under Australian Privacy Principle 11.2, an organisation covered by the Privacy Act 1988 that holds personal information it no longer needs for any purpose authorised under the Act must take reasonable steps to destroy it or ensure it is permanently de-identified.
There are two main exceptions. The obligation does not apply if the information is contained in a Commonwealth record, or if the organisation is required by or under an Australian law, or a court or tribunal order, to keep it. Because APP 11.2 defers to those legal requirements, organisations have to balance privacy-driven data minimisation against their other obligations. In practice the statutory minimum comes first, and the privacy duty to dispose applies once that minimum has passed and there is no business need.
That creates a practical test. Once the legal minimum has passed and there is no business need, the record is a liability rather than an asset. Every extra year of personal information held is more data exposed if something goes wrong.
The OAIC case against Australian Clinical Labs is not a retention case. It is a breach case, and we use it only to illustrate the exposure that comes with holding data. The Federal Court ordered $5.8m in penalties over the Medlab Pathology data breach, including $4.2m for failing to protect data [1]. It shows what is at stake when large volumes of personal information are held and a breach occurs. Less data held means less to protect, assess and notify about.
Public records and private providers
Government agencies and the private providers that work for them face a particular set of rules, and the contract is where they meet.
Ultimate accountability for public records stays with the agency. A contract cannot transfer it. The agency head remains responsible under the Archives Act 1983 (Cth) or the state equivalent for any loss, breach or unauthorised destruction of records.
What a contract can do is transfer the day-to-day recordkeeping duties. Agencies use flow-down clauses so that the provider creates, maintains and secures records to the standard the agency itself must meet, acting on the agency's behalf.
Records created by a provider while delivering an outsourced government function generally remain the property of the Crown or the agency. The provider does not become the owner. For that reason providers have no independent right to delete or wipe those records, even where APP 11.2 would otherwise encourage data minimisation. Destruction needs the agency's approval under an official records authority.
Contracts should also include end-of-contract handback clauses, requiring the provider to return public records in a usable, accessible format or transfer them to an archival authority. If you are a private provider to government, check your contract and get advice before running any automated purge routines.
How to build a retention schedule you can defend
A retention schedule lists each class of record, how long it is kept, what triggers the clock (for example, end of employment or end of contract), and what happens at the end. A defensible one usually has these features.
It is mapped to requirements. Each class is tied to the legislative, regulatory or business requirement behind its period, so the reason is on the record.
It reflects how records are actually kept. A schedule that says seven years while the file share quietly holds twenty is not a control. Talking to records owners about where records live and how disposal really happens often exposes the gap.
It covers all the places records sit. Email, Teams, SharePoint, line-of-business systems, legacy platforms and paper all count.
It has triggers, not only durations. Many periods run from an event rather than the creation date, which is harder to apply than a simple number of years.
It includes approved, evidenced disposal. Disposal should be authorised, recorded and consistent, so you can show why something was destroyed, and that holds such as litigation or investigations were respected.
Common challenges to ask yourselves
Is our retention schedule current, or was it written before our systems, laws or services changed?
Do we have an information inventory, so we know which records exist and where?
Is anyone clearly responsible for records decisions, or is it an accidental job someone does on the side?
Are we keeping records far longer than needed because nobody is confident enough to approve disposal?
If a regulator, auditor or board member asked why we keep a record class for a given period, could we point to the requirement?
For boards and General Counsel, the risk is both sides of the same coin: destroying something that had to be kept, and holding personal information long after it should have gone. For information governance leads and IT managers, the workload issue is usually that a schedule exists on paper but cannot be applied in the systems people use.
A practical first step
The most direct step is a Records retention & disposal review. It is a fixed-scope review of your retention and disposal schedule against legislative and business requirements, and typically takes 2 to 3 weeks. If you are in Queensland, see our [Records Retention and Disposal Reviews, QLD](/records-retention-disposal-review-queensland/) page for the state context.
TFIQ confirms the records, functions and systems in scope, collects your current schedule and procedures, and identifies the legislative, regulatory and business requirements that apply. It interviews records owners about how long records are actually kept and how disposal happens today, then maps each schedule class against the requirements to find gaps, missing classes, over-retention and disposal risks. The deliverables are a retention requirements register, a schedule gap analysis by class, a review report with recommended schedule updates, and a findings presentation, with practical next steps for approval and a first disposal run.
The review does not include legal advice, drafting a new schedule for archives authority approval, sentencing or destroying records, or configuring retention in Microsoft 365 or an EDRMS. If you are not sure where your records and data stand overall, a Data maturity snapshot is a shorter read of 1 to 2 weeks that scores records alongside governance, quality, security and use, and names the five things to fix first.
Frequently asked questions
Is there a standard seven-year rule for records in Australia?
No. Tax records generally have a five-year minimum and detailed employee records seven years, but health, sector and public records each have their own periods. Check the requirement for each record class rather than applying one figure to everything.
Do we have to delete personal information after a set time?
The Privacy Act does not set a fixed deletion date. APP 11.2 requires reasonable steps to destroy or de-identify personal information once it is no longer needed, unless it is in a Commonwealth record or the law or a court or tribunal order requires you to keep it.
Do public sector records rules apply to private providers?
Often, through contract. The agency stays accountable under its records legislation, but flow-down clauses bind providers to keep records on its behalf. Providers generally cannot delete public records without the agency's approval. Check your contract and get advice.
What is a retention trigger?
A trigger is the event that starts the retention clock, such as the end of a contract or employment, rather than the date the record was created. Getting triggers right is often harder than choosing the number of years.
Can we just keep everything to be safe?
Keeping everything is not a safe default. It increases the personal information exposed in a breach and can conflict with APP 11.2. A defensible schedule keeps what is required and disposes of the rest through an approved, recorded process.
Does the review change our Microsoft 365 settings?
No. The review produces recommended schedule updates. Configuring retention in Microsoft 365 is a separate service, Microsoft 365 records management implementation (Purview), which turns an approved schedule into working labels and policies.
Start with a Records retention & disposal review: a 2 to 3 week fixed-scope check of your schedule against what the law and your business require.
Related: Records Retention and Disposal Reviews, QLD · Information Lifecycle Mapping · Information Governance Frameworks · Compliance and Privacy
