Records Retention: There Is No Single Answer, But There Is a Simple Default

ACNC, ATO, Fair Work and state requirements differ. A seven-year minimum default with clear exceptions solves most of the problem

There is no single answer to how long an association must keep its records. Different regulators and different record types specify different minimum periods, and an association applying just one remembered number across every document it holds is very likely applying the wrong figure to at least some of them.

A Patchwork, Not A Single Standard

ACNC-registered charities must keep operational and financial records for seven years under the ACNC Act, the longest of the commonly cited periods for financial records. General tax records are frequently cited at a five-year minimum, and records specifically supporting Deductible Gift Recipient status must be retained for at least five years after the relevant transaction. State and territory incorporated associations Acts set their own periods for financial records, which differ between jurisdictions. Separately, employers covered by the Fair Work Act must keep employee time and wages records for seven years. An association assuming a single figure covers every document it holds has almost certainly gotten at least one category wrong.

The Practical Simplification Worth Adopting

The ACNC requires charities to keep financial and operational records for seven years, and using that as a minimum default also covers most five-year ATO requirements. Rather than tracking a separate period for every financial and operational record type, adopting seven years as the minimum organisation-wide default for these records is considerably simpler to administer and avoids the risk of applying the wrong, shorter period. It is a minimum, not a universal rule: minutes, member and officeholder registers and governing documents are typically kept permanently, and some records carry longer periods, as the next section explains. A retention policy built around remembering which specific period applies to which specific document type is considerably more likely to fail in practice than a single, longer default period applied consistently across everything the association holds.

The Overrides This Default Does Not Eliminate

Standard retention periods can be overridden by a longer requirement in specific circumstances: health records (where state or territory health records laws apply), child safety and incident records, some work health and safety records, and documents relevant to litigation that is reasonably anticipated or already underway. The Royal Commission into Institutional Responses to Child Sexual Abuse recommended that records relating to child sexual abuse be kept for minimum periods that allow for delayed disclosure, which in practice means decades, not seven years. A record otherwise eligible for destruction must be preserved if it falls within one of these categories. The override also runs the other way: if your association is covered by the Privacy Act, Australian Privacy Principle 11.2 requires personal information to be destroyed or de-identified once it is no longer needed, so keeping everything for seven years by default can itself create a privacy problem.

• Adopt seven years as the minimum default for financial and operational records, then list the exceptions: records kept permanently (minutes, registers, constitution), records with longer statutory or recommended periods (child safety, some WHS and health records), and personal information to be destroyed or de-identified when no longer needed.
• Confirm this default covers every regulator your association deals with, such as the ACNC, ATO, Fair Work Ombudsman, and any relevant state or territory regulator or ASIC, rather than assuming one figure automatically satisfies all of them.
• Build an authorisation process for record destruction, ensuring nothing is deleted without a deliberate, documented decision rather than an automatic system purge.
• Preserve any record connected to reasonably anticipated or actual litigation regardless of the standard retention period, since this override exists specifically to prevent the destruction of evidence a dispute may require.
• Apply the data governance and privacy discipline discussed earlier in this series to records containing personal information specifically, since retention and destruction of this category carries its own additional considerations.

Records are one of an association's most consequential assets and one of its most consequential liabilities in equal measure, valuable evidence of the organisation's own good governance when properly kept, and a risk when destroyed too early or retained without any real discipline at all. A single minimum default with clear exceptions, consistently applied and properly authorised, resolves considerably more of this tension than most associations' current, informal approach ever does. This is one of the practical governance topics built into our Board Director course, alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course →

Annie Gibbins

General education, not legal, financial, tax, clinical or governance advice. Confirm specifics at the relevant primary source or with your own qualified adviser. Nexus Leadership is operated by Lipstick Consulting Pty Ltd · ABN 15 619 120 482.