How Long to Keep Business Records in Australia

The three clocks

They overlap messily. A payroll record is simultaneously a tax record and an employee record, so it inherits the longer period. A supplier invoice is a tax record and, for a company, part of the financial records — again, the longer one wins. Trying to run different retention periods for different document types costs more in sorting time than it saves in shelf space.

Tax records — five years, but from when?

The ATO requires most records to be kept for five years. The detail people miss is when the clock starts. The five years runs from when you prepared or obtained the record, or completed the transaction it relates to — whichever is later. Not from the end of the financial year, and not from when you lodged.

What has to be kept: records of income and expenses, and documentation of “any election, choice, estimate, determination or calculation” made for your tax and super affairs. Transaction records need the date, amount and description plus the GST information. Where something is used for both business and private purposes, you need records showing how you split it.

There are also situations where five years isn't enough — most obviously where a record feeds an assessment still within its period of review, and for some fringe benefits tax and super records where the clock starts from a different event.

Employee records — seven years, and strict about form

The Fair Work Act sets seven years for employee records, and unlike the tax rules it is prescriptive about the state those records must be in. They must be:

• In a legible form and in English
• Readily accessible to a Fair Work Inspector
• Not altered except to correct an error
• Not false or misleading to the employer's knowledge

The records themselves cover more ground than most employers expect: names and ABN, start date and basis of employment, pay rates and gross and net amounts, deductions, bonuses and loadings, overtime hours, averaging agreements, leave taken and balances, superannuation contributions with fund names, and on termination the manner of termination and who did it.

Two things worth knowing about the consequences. Employees and former employees can request copies. And where an employer has breached record-keeping obligations, a wage claim carries a presumption in the employee's favour — the absence of records becomes evidence against you rather than merely a gap.

Company financial records — seven years, and it's an offence

Section 286 of the Corporations Act requires a company to keep written financial records that “correctly record and explain its transactions and financial position and performance” and that “would enable true and fair financial statements to be prepared and audited”. Those records must be retained for seven years after the transactions covered by the records are completed.

Failing to do so is an offence under the Act — there is both a fault-based and a strict liability offence for contravening the requirement. This is the clock that catches out directors, because it survives the company's day-to-day operations and becomes acutely relevant if the company is ever wound up.

Paper, electronic, or both

Electronic records are acceptable to the ATO, with conditions: you must be able to extract and convert the data into a standard format such as CSV or Excel, and you must be able to supply encryption keys or password access on request. A file you can no longer open is not a record.

In practice most businesses run both. Digital for the working set, paper for the archive — partly because scanning historical files rarely pays for itself, and partly because a box in a storeroom does not depend on a subscription still being current in year six.

If you go paper for the archive, two things make retrieval survivable: date the box on the outside with its destruction year, not its creation year, and keep a one-page index of what is in which box. The second one takes ten minutes and saves an afternoon.

Then what — destroying records properly

Once a record is past its retention period and no longer needed, holding onto it stops being cautious and starts being a liability. Under Australian Privacy Principle 11.2, personal information must be destroyed or de-identified once it is no longer needed for a permitted purpose. And the regulator is explicit that putting it in the recycling does not count as destruction.

So the retention schedule and the shredder are two halves of the same policy. Our companion guide covers which shredder security level actually applies to your records.

A workable filing rhythm

1. At financial year end, box the closed year. Label it with the destruction year — this year plus seven.
2. Keep the current and prior year in active filing where you can reach them.
3. Once a year, pull any box whose destruction year has arrived, check nothing in it is subject to an open dispute or audit, and shred it.
4. Never destroy anything connected to a live dispute, audit, investigation or legal proceeding, regardless of its age.

That last point matters more than the rest combined. Retention periods are minimums, not deadlines — and destroying records you know to be relevant to a proceeding is a materially different problem from simply keeping them too long.