Olivia is the Head of Legal at Lawpath, where she helps Australian businesses navigate complex legal challenges with practical, commercially minded advice. She specialises in employment matters, contract drafting, pre-litigation strategy, dispute resolution, commercial law and startup compliance, and has supported clients across technology, healthcare, professional services and retail. Olivia is passionate about making legal services accessible, personable and effective for every client.
Document retention requirements in Australia set how long your business must keep its records before it can safely destroy them. The short version: keep most tax records for 5 years, and company financial records and employee records for 7 years. Where more than one rule covers the same document, keep it for the longest period that applies.
Here is the part nobody enjoys. Most business owners only think about records when the ATO asks a question, a former employee lodges a claim, or a dispute lands on their desk. By then the box is already in a skip. This is the admin everyone buries, right up until the moment it costs them.
- Five years for tax, seven for staff and company records. Tax records run 5 years under the Income Tax Assessment Act 1936; employee records and company financial records run 7 years.
- Keep everything for 7 years and you cover almost everyone. It is the simplest safe default for a small business juggling several rules at once.
- The clock often starts later than you think. The period usually runs from when a transaction finishes, not when you first made the record, and an amended tax assessment can restart it.
- Holding records too long is now its own risk. Privacy law tells you to delete personal data once you no longer need it, and a new statutory tort started on 10 June 2025.
- Destroying records tied to a dispute can be a crime. Once litigation is on the horizon, binning relevant documents can trigger penalties and a court assuming the worst.
How long do you have to keep business records in Australia?
There is no single “keep everything for X years” law. Instead, several Acts each set a minimum for the records they care about, and your document retention requirements are the sum of all of them. Miss one and the penalty lands on the company, and sometimes on the directors personally.
Here is how the main periods stack up.
| Record type | Minimum retention | Where it comes from |
|---|---|---|
| General tax and business records (invoices, receipts, GST, BAS working papers) | 5 years | Income Tax Assessment Act 1936, s 262A; ATO |
| Company financial records | 7 years | Corporations Act 2001, s 286 |
| Employee and payroll records (pay, hours, leave, super) | 7 years | Fair Work Act 2009, s 535 |
| Fringe benefits tax records | 5 years from lodging the FBT return | ATO |
| Super contribution and fund-choice records | 5 years | ATO |
| AML/CTF records (if you are a reporting entity) | 7 years | AML/CTF Act 2006; AUSTRAC |
| Telco and internet metadata (telcos and ISPs only) | 2 years | Telecommunications (Interception and Access) Act 1979, s 187C |
| Company set-up documents, trust deeds, property records | Keep permanently (good practice) | Commercial best practice |
The “keep it for 7 years” rule of thumb works because it clears the longest common period in one move. You stop sorting every receipt into a 5-year pile and a 7-year pile, and you stop guessing. For a business with staff, a company structure and the usual tax obligations, 7 years is the number worth building your system around.
Two exceptions are worth a flag. Some records need to outlive 7 years: capital gains and depreciating-asset records should be kept for the life of the asset plus 5 years, because you need them to calculate the gain when you eventually sell. And if you are a telco or internet provider, the 2-year metadata rule is a separate obligation that sits on top of everything else.
How long do solicitors, law firms and property managers keep records?
Some professions carry their own retention rules on top of the baseline above. If you run a law firm or a real estate agency, the 5 and 7-year rules are your floor, not your ceiling, because the body that regulates you sets its own clock for client and trust records.
Solicitors and law firms. Under the Australian Solicitors’ Conduct Rules, a solicitor can destroy a client’s legal documents once 7 years have passed since the matter was completed or ended, unless the client instructs otherwise or a law requires longer. So the answer to “how long do solicitors keep client files” is usually 7 years from when the matter closed. Wills, trust records and title documents are the common exceptions, and firms tend to hold those far longer or indefinitely.
Same trap as tax applies here. The 7 years runs from when the engagement ended, not the day the file was opened, so a matter that ran for three years is on your shelf for a decade all up.
Real estate agents and property managers. Record-keeping for agents is set state by state, not federally. In Victoria, the Estate Agents Act 1980 requires most agency records, including trust-account records, authorities and audit reports, to be kept for 7 years. Other states set their own periods under their agents legislation, so check the rule for yours. Trust-account records in particular are held to a strict standard, and a property manager asking how long to keep records should treat 7 years as the safe default unless their state rule says more.
That pattern holds across regulated work. Your profession layers a longer or stricter rule over the general business baseline, so keep client and trust records for at least 7 years from the end of the engagement, and check your regulator’s rule before you destroy anything.
When does the retention clock actually start?
This is where good businesses still get caught. The clock does not start the day you created the document. For tax records it starts on the later of two dates: when you prepared or obtained the record, or when the transaction or act it relates to was completed.
A quick example. You sign a three-year equipment lease in 2026. The 5-year tax clock on that lease does not finish ticking in 2031. It starts when the lease ends in 2029, so you are keeping those records until at least 2034. People bin the paperwork the moment a deal looks “old” and are short by years.
Amended assessments reset it again. If the ATO amends an assessment, the review period starts over, and the records behind it need to survive the new window. The safe habit is simple: date your retention from when the matter closed, not from when the file was opened.
When does the law make you destroy records?
Retention is only half the job. Australia’s data retention laws push the other way for personal information. Under Australian Privacy Principle 11 of the Privacy Act 1988 (Cth), once you no longer need someone’s personal information for the purpose you collected it, you have to destroy it or de-identify it, provided no other law requires you to keep it.
De-identifying means stripping the data back so it is no longer about an identifiable person. Watch for re-identification, where someone pieces the identity back together from what is left. With the volume of data most businesses now hold, that risk is bigger than it looks.
The same logic covers tax file numbers under the Privacy (Tax File Number) Rule 2015. Once a TFN is no longer needed for tax, super or assistance purposes, it has to go.
Here is the 2026 update that older guides miss. A statutory tort for serious invasions of privacy started on 10 June 2025. A person can now sue over a serious misuse of their information, and the business does not have to be a big APP entity to be exposed. Sitting on a pile of customer data you stopped needing years ago used to be untidy. Now it can be a liability you get sued over, so your privacy policy template, your document retention policy and your destruction schedule need to actually talk to each other.
What about records you might need for a dispute?
One rule overrides your routine destruction schedule entirely. When litigation is underway, pending, or reasonably on the cards, you have a duty to preserve documents that relate to it. This is the Australian version of a litigation hold, sometimes issued internally as a document retention notice, and it is a hard stop on your shredder.
Destroying evidence that is the subject of current or reasonably likely proceedings is a criminal offence. The exact wording shifts between states, but the core offence is broad, and it can bite even where you did not know for certain a document would be used, only that it reasonably might be.
There is a quieter risk too. If you destroy documents that later turn out to matter in a case, a court can treat that gap as a reason to assume the missing records would have hurt you. The lesson is practical. The second a dispute looks possible, freeze destruction on anything connected to it and get advice before you clear anything out. When it is genuinely unclear, hire a lawyer for a quick read rather than guessing.
Where document retention actually goes wrong
Rules are not the hard part. The slip-ups are almost always operational, and the same few come up again and again.
Treating “keep it” as the whole answer. Plenty of owners nail the 7-year habit and never build the other half: a destruction trigger for personal data they no longer need. Since the statutory tort arrived, over-retention has teeth. Keeping everything forever is not the cautious option it feels like.
Faded receipts that prove nothing. Fuel dockets, hardware receipts and most eftpos slips are printed on thermal paper. They can be unreadable inside 18 months, faster if they live in a hot car. An unreadable receipt is not a record. Photograph them the day you get them, before the ink gives up.
Records you technically have but cannot find. The real test is not whether you kept something. It is whether you can produce it in 30 seconds when an auditor asks about a $1,400 purchase from two years ago. A folder of PDFs attached to the right transactions passes. A shoebox does not.
Forgetting who can touch the file. Employee records carry two duties at once: the Fair Work 7-year rule and the Privacy Act. Access should be limited to the people who actually need it, and your employee privacy policy should say so in writing. If you want the detail on the staff side, our guide to employee privacy rights walks through it.
How do you set up a document retention policy that works?
A document retention policy is the one page that turns all of the above into something your team can follow without calling you. You do not need a 40-page manual. You need four things written down.
- Map your records. List the categories you actually hold: tax, payroll, company, contracts, customer data. You cannot set a rule for a record type you have not named.
- Set the minimum period for each. Use the table above. Where two rules overlap, take the longer one and move on.
- Write the destruction triggers. Say what gets deleted, when, and who signs off, including a hard exception that freezes destruction the moment a dispute is possible.
- Store it somewhere secure and searchable. Cloud backup, controlled access, and a structure you can search in seconds. Keep the registered office copy for company records.
Write it once and the policy does the remembering for you. That is the whole point. Lawpath’s document retention policy template gives you the structure to fill in, so you are editing a starting point instead of staring at a blank page.
Frequently asked questions
How long do I need to keep business records in Australia?
Keep most tax and business records for 5 years, and company financial records and employee records for 7 years. Where several rules cover the same document, keep it for the longest period. A flat 7-year rule is the simplest safe default for most small businesses.
How long does the ATO require records to be kept?
The ATO requires most tax records to be kept for 5 years. The period runs from the later of when you prepared the record or when the transaction was completed. Some records, like those for capital gains or depreciating assets, must be kept for the life of the asset plus 5 years.
How long do I keep employee records?
Employee records must be kept for 7 years under the Fair Work Act 2009. That covers pay, hours, leave, and superannuation. Those records are also personal information, so access should be limited and they should be stored securely.
Can I be penalised for keeping records too long?
You can carry risk. Under Australian Privacy Principle 11, personal information must be destroyed or de-identified once you no longer need it and no law requires you to keep it. Since 10 June 2025, a statutory tort for serious invasions of privacy has also made over-holding personal data a potential liability.
Can I store business records digitally?
Yes. Digital records are accepted as long as they are accurate, complete, in English, and able to be produced when asked. Digital is usually better than paper, because it does not fade and you can find a document in seconds. Photograph thermal receipts the day you get them.
What happens if I destroy a record that was needed for a dispute?
Destroying documents relevant to current or reasonably likely litigation can be a criminal offence, and a court may assume the missing records would have counted against you. Freeze all destruction the moment a dispute looks possible, and get legal advice before clearing anything connected to it.
What is the penalty for not keeping records?
Failing to keep required tax records can attract an administrative penalty of 20 penalty units under tax law, plus flow-on consequences if poor records lead to an incorrect return. Failing to keep company or employee records can also trigger ASIC and Fair Work action against the business and its directors.
How long do solicitors have to keep client files?
Under the Australian Solicitors’ Conduct Rules, a solicitor can destroy a client’s legal documents 7 years after the matter ends, unless the client instructs otherwise or a law requires longer. The 7 years runs from when the engagement finished. Wills, trust records and title documents are usually kept far longer.
How long do property managers and real estate agents keep records?
Record-keeping for real estate agents is set by each state. In Victoria, the Estate Agents Act 1980 requires most agency and trust records to be kept for 7 years. Other states set their own periods under their agents legislation, so check the rule for yours. Treat 7 years as the safe default.
Do sole traders have the same record-keeping rules?
Sole traders follow the same 5-year tax rule as everyone else, but have no company records to worry about. If you hire staff, the 7-year employee-record rule applies to you too. Keeping everything for 7 years is still the cleanest approach once you have employees.
The one thing to do next
If your records live in a mix of drawers, inboxes and half-remembered folders, you are not behind. That is where most small businesses start. The fix is not a weekend of filing. It is one clear policy that tells you, and your team, what to keep, for how long, and when to let go.
Set the rule once and the hard part is done. Start your document retention policy today, and sort it before the ATO, a dispute, or a privacy claim sorts it for you.
