A data retention policy sets out which records your brokerage keeps, why it keeps them and when it destroys or de-identifies them. Credit assessments need to remain available for the statutory seven-year request period. Other records have different starting points and retention rules.
Set the period for each record type before clearing an old client folder. A settled loan, a closed client relationship and an expired tax-record period can each lead to a different disposal decision.
What a Data Retention Policy is
A data retention policy is your written rule for keeping records for an identified purpose and disposing of them when that purpose ends. Data retention includes paper files, emails, recordings and information held by software providers on your behalf.
For a business covered by the Privacy Act, Australian Privacy Principle (APP) 11.2 requires reasonable steps to destroy or de-identify personal information no longer needed for a permitted purpose. An Australian law or court or tribunal order requiring retention overrides that disposal requirement. The Office of the Australian Information Commissioner’s APP 11 guidance explains these conditions.
An old file is not automatically ready for destruction. It might still support an active complaint or a legal obligation. Equally, a reason to keep the assessment does not automatically justify keeping every spare download and duplicate attachment.
Use a retention schedule to apply the policy. Each schedule entry names the record, its required period and the event that starts that period. A disposal review then decides whether another documented reason requires you to keep it longer.
How Long to Keep Broking Records
Keep broking records for the period that applies to the record and its purpose. A blanket instruction to delete every file seven years after settlement misses different statutory starting points.
Retention Periods by Record Type
| Record type | Period or rule | Starting point or condition |
|---|---|---|
| Consumer credit preliminary assessment | Keep it available throughout the seven-year consumer request period under section 120 of the NCCP Act | The credit assistance quote date specified in that provision |
| Best interests duty evidence | Set a documented period appropriate to the product and the need to demonstrate compliance | Consider the loan term, interest-only period and refinancing, as ASIC RG 273.168 explains |
| AML/CTF customer due diligence records, where the brokerage has the relevant reporting obligations | Seven years after the business relationship ends or the occasional transaction is completed | Section 111 of the AML/CTF Act |
| AML/CTF transaction records, where applicable | Seven years beginning when the record is made | Section 107 of the AML/CTF Act |
| Customer-provided AML/CTF transaction documents, where applicable | Seven years after the document is given | Section 108 of the AML/CTF Act |
| Most business tax records | Generally five years after preparation, receipt or completion of the relevant transaction, whichever is later | Longer rules apply to some records, including records used in later tax calculations |
The National Consumer Credit Protection Act 2009 (NCCP Act) sets the assessment request rule in section 120. The Australian Securities and Investments Commission (ASIC) explains the disclosure requirements in its responsible lending guidance.
Keep the assessment retrievable, including when a credit representative leaves or changes licensee. Agree who holds the records and how an authorised person obtains a copy. Do not substitute the loan’s settlement date for the legal trigger without an applicable basis.
ASIC’s RG 273: Mortgage brokers: Best interests duty takes a case-dependent approach to the supporting evidence. A minimum request period is therefore not a universal instruction to destroy the whole file immediately afterwards.
Apply AML/CTF Rules to the Services You Provide
Anti-money laundering and counter-terrorism financing (AML/CTF) retention duties depend on the services and obligations that apply to the business. The AML/CTF Act’s record-keeping provisions set different triggers for due diligence and transaction records.
Do not assume the 2026 reforms make every mortgage broker a reporting entity. The Mortgage & Finance Association of Australia and the Commercial & Asset Finance Brokers Association report that AUSTRAC is reviewing the position for commercial finance broking. Their joint statement on the scope review records advice that compliance steps are not expected until that position is finalised and published.
Record which services your brokerage provides and the basis for applying any AML/CTF schedule entry. Distinguish your own obligations from records you collect for a lender under its instructions.
For tax records, the Australian Taxation Office’s business record-keeping rules explain the general five-year period and exceptions. The tax period applies to business tax evidence, not automatically to the complete credit-assistance file.
Write the Policy
Write a data retention and disposal policy that an administrator can follow without guessing which files to delete. Give each record category an owner and an approval step before destruction.
- List the records and every storage location. Include the client system, shared drives, staff mailboxes, paper archives and outsourced services. Record exported copies and backups too.
- Assign the applicable retention rule. State the source, period and starting event for each category. Where several rules apply to the same record, use the longest applicable requirement.
- Define access and storage. Name the approved system, authorised roles and backup arrangement. Explain how records remain readable after a software change or staff departure.
- Add a hold process. Suspend routine deletion for a complaint, investigation or court order that requires the records. Name who can place and release a hold, with a recorded reason.
- Set the disposal method and approver. Specify secure paper destruction, digital deletion or a documented de-identification process. Require evidence that the approved batch was processed.
- Schedule a review and test it. Select an expired record, a held record and an active record. The process must select only the expired record for approval and explain why the others remain.
Use this sentence pattern as a data retention policy template for each category:
Keep the named record in its approved storage location for its applicable period, measured from the specified event. The record owner reviews disposal eligibility. The authorised approver releases eligible records for the recorded destruction method after checking holds.
Fill each element with your brokerage’s actual category and rule. A schedule saying only “client files: seven years” leaves the administrator without a starting event or a way to handle exceptions.
For example, consider a hypothetical former client’s assessment, tax evidence and temporary working copies. The assessment still within its statutory request period stays available. Working copies with no remaining permitted purpose can enter disposal review, subject to holds and any other applicable requirement.
Destroy Records and Get a Certificate of Destruction
Destroy records only after the retention review confirms that the approved batch has no remaining requirement or permitted purpose. Keep a disposal log that identifies the category and approval without reproducing the client documents being destroyed.
For paper, use a secure collection and destruction process. Ordinary recycling leaves readable records exposed. For digital storage, emptying a desktop folder or moving a file to the recycle bin does not establish irreversible deletion. Include synchronised copies and exported files in the disposal task.
The OAIC’s Guide to securing personal information covers secure destruction and backup handling. If immediate deletion from a backup is impracticable, document how it is put beyond use and when it will be destroyed. A restored backup must not silently return disposed records to everyday use.
Include AI Tool Histories
Include client information placed in artificial intelligence (AI) tools in the same disposal review. Identify the account, uploaded files and conversations that hold it. Capture any output that must remain in the authorised client file before deleting an unnecessary working copy.
Use the provider’s documented deletion controls and address shared links or connected storage separately. Record any remaining provider retention and its contractual basis. Treat hiding or archiving a conversation as a separate action from deletion.
Request Destruction Evidence
Request a certificate of destruction when you outsource confidential paper destruction or dispose of storage equipment through a contractor. Make this a condition of your purchase order. Ask the provider to identify the batch or device serial numbers, destruction method, completion date and responsible provider.
A certificate records what the contractor says it destroyed. Match it to your approved disposal list and collection record. It does not establish that unrelated cloud copies or backups were deleted.
For in-house deletion, retain the approval, operator and completion evidence in your disposal log. Close the task only when the selected records are unavailable through ordinary search and any backup exception has a recorded owner and expiry process.
