Retention schedule

How to use this

IPP 9 says you must not keep personal information longer than you need it for a lawful purpose. Most organisations keep everything forever, which turns every breach into a bigger breach.

The CSV includes common record types with starter periods. Where a law sets a minimum, we’ve named it, but laws change, so confirm the current requirement before adopting a period. Where no law applies, you choose a period and record why.

Retention schedule: guidance

Setting a period where no law sets one

Ask three questions:

1. How long do we actually use it? Look at when the information was last needed in practice.
2. What could we need it for afterwards? Handling complaints, defending a legal claim, answering an audit. Limitation periods for many civil claims are commonly around six years, which is often why organisations choose six or seven years for transaction records. Take advice if this matters.
3. What’s the harm if we keep it and it leaks? The more sensitive the information, the stronger the case for a short period.

Write the reason in the schedule. “We might need it someday” isn’t a reason.

Making deletion happen

A schedule nobody runs is worse than none, because it shows you knew. For each record type:

• Name an owner responsible for disposal.
• Automate where you can, with retention policies in Microsoft 365 or Google Workspace, automatic CCTV overwrite, and scheduled deletion in your CRM.
• For manual disposal, set a recurring calendar reminder and record the date disposal was done.
• Include backups in your thinking. Information in a backup is still held. It’s acceptable for backups to age out on their normal cycle, as long as you don’t restore deleted information for new uses.
• Destroy paper by secure shredding, and wipe or destroy devices before disposal or resale.

Legal holds

If you’re aware of a likely legal claim, complaint, investigation or access request involving certain records, suspend disposal of those records until it’s resolved. Deleting information to avoid an access request is an offence under the Privacy Act.