Data retention policy: an Australian guide and template

A data retention policy sets out what personal information your business keeps, for how long, and how you get rid of it. If the Privacy Act 1988 (Cth) covers you, you must destroy or de-identify personal information once you no longer need it, and the policy is how you keep track.

It matters more than it sounds. Every old enquiry, booking and spreadsheet sitting in a system is something that can leak. The OAIC makes the same point: the more personal information you hold, the bigger the harm to people, and to your business, if there is a breach.

What is a data retention policy?

A data retention policy is a short internal document that lists the types of personal information you hold and how long you keep each one. It usually has two parts: a retention schedule (what, where, why and how long) and a process for destroying or de-identifying records when their time is up.

It is not the same as your privacy policy. Your privacy policy is public and explains how you handle information in general, and it is a good place to say roughly how long you keep things. Our guide to privacy policy requirements in Australia covers what that public document needs to include. The retention policy is the working detail behind it.

What does APP 11.2 require?

Australian Privacy Principle 11.2 requires you to take reasonable steps to destroy or de-identify personal information once you no longer need it for any purpose the APPs allow. The main exception is where an Australian law or a court or tribunal order requires you to keep it. (There is also an exception for Commonwealth records, which mostly affects government agencies.)

A few details from the OAIC’s guidance that catch businesses out:

• Every copy counts. The obligation covers archived copies and backups, not just the live record.

• Your suppliers count too. If a cloud provider or software tool stores information for you and you control it, you still hold it. If you ask them to delete it, check that they have.

• Inconvenience is not an excuse. What is reasonable depends on how much information you hold, how sensitive it is, the size of your business and the harm a breach could cause. Cost or hassle alone does not get you out of it.

• Policies are part of it. Since 11 December 2024, reasonable steps include both technical measures (like secure deletion) and organisational ones (like written procedures and staff training).

Not sure whether the Act applies to you at all? Start with does the Privacy Act cover small business, then see where APP 11 sits in our Australian Privacy Principles explainer.

What counts as destroyed?

Information is destroyed when it can no longer be retrieved. For paper, that means shredding, pulping or a secure document bin, not the recycling. For electronic records, it means deleting them properly, including from backups. If a record genuinely cannot be deleted for technical reasons, the OAIC expects you to put it beyond use: you will not use or share it, nobody else can access it, it stays secured with access logs, and you delete it as soon as you can. The OAIC expects that situation to be rare.

What counts as de-identified?

Information is de-identified when it is no longer about a person who is identified or reasonably identifiable. Removing a name is often not enough, because other details can point back to someone. If you cannot keep the risk of re-identification low, destroy the record instead.

How long should you keep records in Australia?

It depends on the record. Some laws set a minimum period, and for everything else you choose a period based on why you collected the information. Here are common examples for small businesses:

• Tax and business records: generally 5 years. The ATO’s general rule is five years, with longer periods for some records, such as those for capital gains and depreciating assets, which are kept while you own the asset and for five years after. Source: ATO, records you need to keep for longer than five years.

• Employee records and pay slips: 7 years. Source: Fair Work Ombudsman, record-keeping and pay slips.

• Company financial records: 7 years. Companies keep them for at least seven years after the transactions are complete, under section 286 of the Corporations Act 2001 (Cth). Source: ASIC, company record keeping.

• Health records held by NSW private providers: 7 years, or until age 25. Adult records are kept for seven years from the last service, and records collected while the patient was under 18 until they turn 25. Other states and territories have their own rules. Source: Information and Privacy Commission NSW. More for clinics on our healthcare privacy page.

• Real estate agency records: depends on your state. Sales files, property management files and trust records are covered by state agency laws, and the periods differ. Check with your state’s fair trading or consumer affairs regulator.

• Website enquiries, leads, unsuccessful job applications and marketing lists: no set period. No law sets a minimum, so APP 11.2 does the work. Pick a period that matches why you collected the information, and delete it after that.

A legal minimum is a floor, not a reason to keep things indefinitely. Once the period ends and you have no other permitted purpose, APP 11.2 applies. If a record relates to a dispute, complaint or claim, get advice before you destroy it.

How do consent records fit in?

Consent records belong in your data retention policy like any other record. A consent record shows who agreed to what and when, for example a visitor’s cookie choices or someone signing up to your newsletter. Because it can include an IP address, email address or device identifier, it can be personal information.

Keep consent records for as long as you rely on that consent and might need to show what someone agreed to. When the consent is withdrawn or replaced, or you stop the activity it covered, review whether you still need the old record. A short opt-out list, so you do not contact someone again after they unsubscribe, is a common reason to keep a small amount of information.

Data retention policy template

Copy this, replace the words in brackets with your own details, and keep it somewhere your team can find it.

(Business name) data retention policy

1. Purpose. This policy explains what personal information (Business name) keeps, how long we keep it, and how we destroy or de-identify it when we no longer need it.

2. Who it applies to. All staff, contractors and suppliers who handle personal information for us.

3. Retention schedule. For each type of record we list: what it is, where it is stored, why we keep it, how long we keep it, and what happens at the end. For example: website enquiries, stored in (system), kept to respond and follow up, deleted (period) after the last contact.

4. Destruction and de-identification. Paper records are shredded or placed in a secure document bin. Electronic records are deleted from live systems, backups and supplier systems. We ask suppliers to confirm deletion.

5. Exceptions. If a law or a court or tribunal order requires us to keep a record, or the record relates to a dispute or complaint, we keep it and note why.

6. Responsibility and review. (Name or role) is responsible for this policy. We review it every 12 months and whenever we add a new system. We keep a log of what was destroyed or de-identified, and when.

How to put your data retention policy in place

1. List every place personal information lives

Think beyond the obvious: web forms, your inbox, CRM, booking system, accounting software, spreadsheets, paper files, backups and website plugins. The free website privacy scanner shows which cookies and trackers your site sets, which is a quick way to spot tools you had forgotten about.

2. Write down why you keep each record

If you cannot name a current purpose for a record, that is your first sign it should go.

3. Set a period for each record type

Start with any legal minimum, then add a sensible buffer only where you have a real reason.

4. Check your suppliers can delete

Find out how each tool deletes records, including backups, and how you can confirm it has happened.

5. Make deletion a routine and record it

Put a recurring date in the calendar, run the deletions, and note what went and when.

6. Make your privacy policy match

If your privacy policy says how long you keep information, make sure it agrees with your schedule. Our privacy act checklist is a good next pass over the rest of your practices.

Source: Chapter 11: APP 11 Security of personal information, Office of the Australian Information Commissioner, updated 3 October 2025.

This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.