Employee Records
Part of HR software privacy and permissions
Reviewing data retention settings with current requirements
Compare HR system retention, archive and deletion settings with requirements for each Australian employee record category.
Review HR software retention settings one record category at a time. Match each category to its retention period, instrument and starting event, then check the system’s archive, deletion, export and backup behaviour. Do not assume one period fits every record.
Separate obligations from storage defaults
Inventory the HR platform and connected tools. Include employment and pay records, supporting documents, requests, exported reports, audit logs, integration copies and backups. For each category, name its owner and the system holding the authoritative record.
| Record category | Decision for the owner |
|---|---|
| Required employment or wage record | What rule applies, when does the period start and how will the record be retrieved? |
| Supporting document | Is it needed to explain a retained decision, or does it have another purpose and end point? |
| Export or integration copy | Who controls the copy, and when is it removed or replaced? |
| Log or backup | What does it contain, who can access it and how does it expire? |
Time and wage records have a seven-year retention period, counted from the date each record is made, under the Fair Work Regulations. Use that date as the start event, not the employee’s departure date.
Leave records have a seven-year period under the Fair Work Regulations. Set a category-specific start event rather than automatically applying the time-and-wage trigger.
Employment contracts must be retained for seven years after termination, with the Fair Work Act and tax law as the stated basis. Termination documents have a seven-year period after termination under the Fair Work Act.
Keep superannuation records for five years under SG legislation. Keep tax and financial records for at least five years after filing the tax return under tax law; tax file number declarations have a seven-year period after employment ends under ATO requirements.
Use the Fair Work Ombudsman’s record-keeping guidance alongside the Fair Work instruments, and map only the categories those requirements cover. Do not apply their periods automatically to every attachment, notification or log.
For a time-and-wage record, a schedule entry can state: basis, Fair Work Regulations; start event, date made; period, seven years; review point, expiry; end action, destroy or de-identify when no permitted purpose requires retention. If an Australian law or court or tribunal order requires retention, keep the record for that obligation.
Check the rule for each holder
Under the Privacy Act 1988 (Cth), APP 11.2 requires an APP entity to take reasonable steps to destroy or de-identify personal information it holds when it is no longer needed for a purpose permitted under the APPs. This is not a fixed-year period; exceptions include Commonwealth records and retention required by Australian law or a court or tribunal order.
The OAIC’s APP Guidelines, Chapter 11, covers APP 11: Security of personal information; the chapter was updated on 3 October 2025. APP 11.3 includes technical and organisational measures among reasonable steps and applies to information held after 11 December 2024.
Check the OAIC’s employee-records exemption guidance when deciding whether privacy obligations apply to each category. Assess employer and provider handling separately.
Record the retention basis, start event, review point and end action for each setting. A dispute, investigation or other preservation requirement may affect that action, so have the responsible specialist assess it rather than letting a timer decide.
Compare the schedule with actual behaviour
Ask the system owner or supplier to show what happens when an employee leaves, a document is replaced, an account closes and a record reaches its scheduled end. Compare the retention period, start event and end action with the category schedule, and distinguish hiding or archiving a record from deleting it. Check whether required history can be retrieved before and after a change.
Examine copies separately. Deleting a live profile entry may leave an export, email attachment or backup. Ask the provider what can be deleted immediately, what remains temporarily and how it is protected until removal. Treat unshown behaviour as unverified.
Keep the approved schedule beside the configuration version. After a change, use protected sample records to check retrieval of a required record and the stated treatment of one whose period has ended. Revisit the schedule when a requirement, contract, data flow or system behaviour changes.
