Many small businesses keep every customer record forever, because deleting feels risky and keeping feels free. Under the Privacy Act, keeping personal information with no reason to hold it is itself a risk.
What the rule says
Australian Privacy Principle 11 says that when a covered business no longer needs personal information for any purpose it can lawfully use it for, it must take reasonable steps to destroy it or de-identify it. The exception is where the law requires you to keep it.
Why it matters
Old data is still data that can be exposed in a breach. The more you hold, the larger the impact if something goes wrong, and the more people you may have to notify. Less data means less exposure.
Some records you must keep
Tax, employment and corporate laws often require records to be kept for a set period, commonly several years for tax records. Keep those for as long as the law requires, then review them. Check the specific period for your records with your accountant.
How to build a simple retention schedule
- List the types of personal information you hold: customers, leads, staff, suppliers
- For each, write the reason you hold it and the longest you may need it
- Note any legal minimum period
- Set a reminder to delete or de-identify on a regular schedule, such as yearly
Do not forget the copies
Deleting a record from your main system does not help if the same data sits in old email attachments, exported spreadsheets and backups. Include those in the review.
What to do this week
- Find your oldest customer or lead list
- Decide whether you still have a genuine reason to hold it
- If not, delete or de-identify it and note the date
This is general information, not legal advice. If you are unsure how this applies to your business, speak with a qualified privacy lawyer and see the OAIC guidance.