Is there one email retention period in Australia?
No. Email is a format, and the obligation attaches to the information inside it. A supplier's tax invoice sent as a PDF is a tax record. A message agreeing a pay rise belongs with the employee's records. A thank-you note usually has no legal retention period. That is why a single rule such as 'keep everything for 7 years' fails in both directions. It can keep personal information long after it is needed, which APP 11 asks you to destroy or de-identify, and it can still lose a record when a staff member deletes mail from a personal folder. Start by listing the record types that arrive or leave by email in your business.
What does the ATO require?
The ATO says you need to keep most records for 5 years. The period generally starts from when you prepared or obtained the record, or completed the transactions it relates to, whichever is later. Some records start differently, for example FBT records from the date you lodge the FBT return, and some must be kept longer than 5 years, including to cover the review period for an assessment that used the record. The ATO also says records must be stored so they are protected from change, that you must be able to reconstruct original data if your record-keeping system changes, and that you keep information about any routine procedures you use to destroy digital records.
What do ASIC and Fair Work require?
ASIC says companies must keep financial records for at least 7 years. Financial records include invoices, receipts, cheques, books of prime entry and working papers. They can be electronic, as long as you can create hard copies within a reasonable time when asked. The Fair Work Ombudsman says employee records must be kept for 7 years, be readily accessible to a Fair Work Inspector, be legible and in English, and not be altered except to correct an error. Pay, hours, leave and termination records are among those employers must keep, and approvals for them often arrive by email.
What extra applies to financial advisers?
ASIC's FAQs on Records of Advice say an AFS licensee should keep ROAs for at least 7 years after the day the personal advice is provided to the client. Licensees must also keep records of the information they relied on to show they prioritised the client's interests, under notional section 912G as inserted by ASIC's 2024 record-keeping instrument. Client emails that carry instructions, fact-find answers or explanations of advice can form part of that record. Archive them against the client file instead of leaving them in one adviser's inbox, so they stay available if that adviser leaves.
When must you delete emails?
APP 11.2 says that once an APP entity no longer needs personal information for any purpose permitted under the Australian Privacy Principles, it must take reasonable steps to destroy it or make sure it is de-identified. The exception is where an Australian law, or a court or tribunal order, requires you to keep it. A retention schedule therefore needs an end as well as a start. When the period for a category ends and no other purpose applies, delete the emails and attachments, including copies held by connected tools such as CRMs, helpdesks and AI services.
How do AI email tools change retention?
An AI email service can create new copies of your mail: processed text, summaries, drafts, logs and search indexes. The OAIC explains that an entity holds personal information if it has possession or control of a record containing it, and that extends to records it has the right or power to deal with. Ask the vendor where each copy lives, how long it is kept and how it is deleted when your schedule says so. Make sure the tool does not delete mail on rules of its own, since the ATO expects you to keep information about routine procedures for destroying digital records.
- Which copies of email content the tool stores, including logs and indexes.
- Where those copies are stored and for how long.
- How deletion is triggered, and how you confirm it happened.
- What happens to the copies when you stop using the service.