How long to keep records

Detailing the importance of a record retention schedule for your business.

Organisations today are beholden to legal and regulatory requirements regarding the retention of secure documents. With policies and procedures changing, it can be difficult for a business to ensure compliance with current legislation – to say nothing of the challenge associated with transferring old paper documents to electronic records.

The burden of maintaining line of sight into when policies lapse, expire or update adds anxiety for many business leaders and records and information management professionals. Imagine if you had access to a platform that could handle the nuances of regulatory compliance while securing your valuable information from the threat of data breach or loss?

A comprehensive records retention protocol is essential for your business – let’s examine the challenges and best practices associated with creating one.

Featured Services

Retention and privacy policy management

Find your path to to efficient, cost-effective, and compliant information governance

Iron Mountain InSight Digital Experience Platform

Access information from a unified, automated, secure platform

Retention policy development and advisory services

Know your obligations and show compliance with our online policy centre tool

Examples of data retention policies include:

Records retention and your business

A records retention schedule (RRS) is defined as a policy that outlines how long your business is required to keep data assets, as well as the proper disposal guidelines for those items.

Record keeping is an important aspect of your organisational operations. Regulatory requirements or laws may influence the length of data retention periods. It’s always considered best practice to align the period of time your business intends to store information with the corresponding governance rules.

When it comes to the disposal of data, including personally identifiable information (PII), it is imperative to ensure that you’re in alignment with data protection regulation standards. Established in 2020, The P rivacy Act serves to protect the privacy of individuals and govern how businesses utilise personal information.

Taxes and financial regulations

Business regulations.

Employee wage and hour rules.

The Australian Work Health & Safety Act (WHS)

Health and Safety at Work Act

Ensuring proper retention of records and documents not only keeps your company in compliance with current regulations, but it also enables a clear line of sight for both institutions and employees to access relevant information. Client trust and employee loyalty are key drivers in business operations, and the protection of personal data is vital to establishing integrity for your brand.

The risk of not having a records retention schedule

Records retention has become increasingly complex due to the rapidly increasing volume of electronic messages and documents. The frequent implementation of regulations – such as Australia’s Dec 2021 introduction of increased fines for a data breach – has found the process of record disposal to be an area of corporate risk and management focus.

Businesses found to be in violation of records retention regulations may be subject to heavy fines and penalties, in addition to the social damages attributed to a breach of PII. With organisations required to record a data breach, the damages to potential future customer or business acquisitions are intangible but worth acknowledging.

As reported by IBM, the average cost of a data breach in 2020 was AU $3.35 million per breach, an increase of 9.8% over the previous year. The cost of a stolen or lost record was $163, an increase of 3.8% contrasted against the 2019 averages. The report indicates that 80% of recorded incidents resulted in the exposure of PII, and took over 200 days for businesses to identify.

Organisations are subject to legal recourse if violations are revealed to have been preventable by the presence of significant protection protocols for valuable documents.

Records requiring retention, and the corresponding length of time they should be kept, as defined by current Australian regulations

Business records: permanent

Examples include:

Corporate identity documents
charters
bylaws
as well as any patents or trademarks
and annual financial statements.

Health records: 10 years

Examples include:

Medical information
patient history
charts
scans and records

Tax records: 7 years

Examples include:

Bank statements and records
vendor invoices
and all personnel and payroll records

Your RRS should be periodically updated to maintain adherence with local governance. An 18-24 month schedule is a general best practice, as this timeframe allows your business to ensure that any enacted legislation or legal changes are accounted for with the latest revision. To stay abreast of the latest policy changes, and to avoid fines and potential data vulnerabilities, many businesses have tasked external RRS providers with the security of their valuable files and documents.

The foundation of a defensible records management program is a comprehensive retention schedule. By identifying retention periods and adhering to timely disposal of unnecessary records, your business maintains the trust of customers and employees who share their PII.

Businesses often outsource records retention schedule operations to service providers whose sole purpose is to ensure data privacy and protection in line with government regulations. From critical business information to original incorporation documents, your valuable assets are protected when partnering with specialists in data management.

You’re not alone in finding the intricacies of a proper RSS protocol daunting.

The penalties associated with keeping information past its proper lifecycle, the confusion over understanding the latest record retention policy changes you’re beholden to and the inability to articulate compliance to regulators have created unnecessary burdens for many Australian businesses.

There’s no need to leave file cabinets and hard drives full of documents and records you’re no longer sure you are required to keep.

Secure storage

Preserve your important records with highly secure and compliant offsite storage

With Iron Mountain Policy Centre, you can enjoy instant and comprehensive insight into the valuable records retention information critical to your business – all in one place. Our cloud-based retention policy management platform provides you with a unified view of all personal data, complete with dashboard updates as to when it's time to dispose of PII.

When you’re able to manage privacy and retention together, efforts to align critical data with regulatory compliance is no longer a source of anxiety or productivity loss for your business.

Want to stay up to date on the latest retention and privacy law changes? With a click of a button, the Maintenance tab accessed from your customised dashboard provides you with the latest amendments to the regulations that govern your industry.

Interested in the latest legal citations that outline your compliance requirements? Policy Centre will fully cite and summarise up-to-date changes in a way that makes the information both accessible and easily digestible by your workforce.

Retention policy development and advisory services

Know your obligations and show compliance with our online policy centre tool

Retention and privacy policy management

Find your path to to efficient, cost-effective, and compliant information governance

We offer four subscription tiers tailored to the level and complexity of your organisation’s information governance (IG) or records and information management (RIM) program.

Iron Mountain Policy Centre Enterprise Edition protects your valuable resources from data breaches while keeping your retention and privacy policy management connected, current and compliant. You’ll save on information disposal costs, and enjoy the ability to quickly access what you need, when you need it.
Iron Mountain Policy Centre Professional Edition is an excellent choice if privacy isn’t your primary concern, but you’re still interested in the expert advisory services to help customise your storage and retention schedule.
Our Corporate Record Retention Policy Management provides oversight into the lifecycle of each piece of data in your organisation, from creation through to its use and deletion. Our comprehensive records management service ensures the data vital for your business goes from bottlenecked to streamlined. We keep up-to-date data privacy regulation standards and requirements so you can maintain 100% adherence to the protocols that encompass your operations. With online visibility into retention renewal timelines and critical information regarding the processes that govern your personal data, Iron Mountain is committed to protecting your business.
The Iron Mountain Retention Policy Management service gives you the assurance that your business is in full compliance with the Australian Privacy Act 1988, and provides you with a unified view of your personal data. Our disposal schedule service will take care of all unnecessary documents as soon as legally obligated to do so, protecting your workplace from the potential of PII loss or data breach.

Iron Mountain makes privacy policy adherence easy, saving your business the risk of incurring fines and penalties. Our Record Management service will help you develop and implement a programme that handles both physical and digital assets, transitions necessary files and offloads the disposal and security of unnecessary data from your workforce.

Together with Iron Mountain Policy Centre, your business will be able to fully comply with the relevant document retention policies and laws based on where you operate. Along with up-to-date and connected privacy policy compliance, automatically calculated destruction eligibility ensures you’re never holding on to information longer than necessary. Backed by the latest data breach protection solutions, Policy Centre enables your business to remain vigilant and focused on records retention compliance efforts with ease.

Take the worry out of data retention with Iron Mountain today.

Get in touch with us

By submitting this form I agree that Iron Mountain may process my data in the manner described in Iron Mountain's Privacy Notice. If you agreed to receive marketing emails but subsequently change your mind, you may opt out at any time here.

Iron Mountain Elevate the power of your work - man with glasses looking ahead

Why Iron Mountain ?

We have the experience and expertise to streamline your organisation while keeping your enterprise and customer data safe and secure. Together, we elevate the power of your work.

About Us