There is no single retention period for all Australian business records. Businesses commonly need to keep tax records for five years, while employee time and wage records generally need seven. Other requirements depend on the record, the relevant law, the jurisdiction, the contract and the business purpose.
People often repeat five years as the answer to business record retention in Australia. However, it is not a universal rule. Different requirements and different trigger dates can govern a payroll record, a contract, a tax document and a health record. So the practical task is to identify the record class and the authority that applies to it.
How long must business records be kept in Australia?
There is no single retention period for every business record in Australia. Instead, different laws, regulators, industries and business purposes apply. A retention schedule should identify the record class, the rule that applies, the event that starts the retention clock and what happens when the period ends.
ATO requirements: five years is a common rule
The Australian Taxation Office says businesses generally need to keep records relevant to their tax, superannuation and registration affairs for five years. Some records need longer, for example where you reuse the information in future returns or where it relates to assets. So treat five years as a common tax rule, not a universal business-record rule.
Company records: check the Corporations Act and your obligations
Employee records under the Fair Work system
The Fair Work Ombudsman states that employers must keep time and wages records for seven years. Employee records also carry requirements around accessibility, legibility and accuracy.
Health records are different again
Privacy obligations, sector rules and state or territory requirements can all apply to health information. So before you set a destruction date, identify the jurisdiction, the record type and the applicable authority.
Destroying something too early
Premature destruction can remove evidence your organisation must retain, or still needs for business, legal or regulatory purposes. So authorise disposal, document it and link it to the rule behind the decision. Once you properly authorise disposal, organisations should destroy them securely and keep suitable evidence of the action.
Keeping everything forever
Keeping information indefinitely also creates cost and risk. After all, more information means more material to store, find, protect and assess if an incident occurs. So good governance aims for defensible retention rather than automatic accumulation.
Building a schedule instead of guessing
A records retention schedule turns individual legal and business requirements into repeatable rules. Maintain it as obligations and business processes change, and seek specialist legal or records advice where requirements are uncertain. In practice, the way to apply different rules consistently is to keep a retention schedule that identifies the authority, trigger, period, owner and final action for each record class.
Frequently asked questions
Can we destroy a record when its minimum period ends?
Not automatically. Check whether another legal, contractual, business or investigation need still applies, then follow the organisation’s approved disposal process.
Does digitising a record change its retention period?
Digitisation changes the format, not necessarily the obligation. Confirm requirements for authenticity, accessibility and any need to retain the original.
Who should approve retention rules?
Ownership varies, but records, legal, privacy, compliance and relevant business owners should be involved where the rule affects their obligations.
How Grace can help
If retention decisions are inconsistent across paper and digital information, a structured review can identify the record classes, authorities, owners and disposal controls that need attention.
Talk to our information governance specialists to discuss the problem, the information involved and the most useful next step.
This article is intended to provide general information and commentary on records management, information governance and related regulatory developments. It does not constitute legal, regulatory, compliance or professional advice. Readers should obtain independent advice appropriate to their circumstances before acting on any information contained in this article.
