Australian cloud for business software — built and run in Sydney since 2003

+61 2 8282 5656
support@netleverage.com
Talk to an engineer
Talk to an engineer
NetLeverage
NetLeverage

Backups are not record keeping: Australian retention periods and what holds them

Technical article
Backup & Recovery

Originally published:

About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.

Ask a small business how long it keeps its records and the answer is often about backups: a nightly copy, kept by the provider for 30 days. That answers a different question. Backups exist to undo a recent loss. Record keeping is a legal duty to hold particular records for years, in a form a regulator can read.

This guide is for business owners, finance managers and the people who look after their systems. It sets out the main Australian retention periods from regulator guidance, what those regulators expect of electronic records, and how to make sure the records actually exist, intact, at the end of the period. It is general information, not legal or tax advice; your accountant or lawyer should confirm what applies to you.

Why it matters

The gap is easy to miss (our reading). A backup system keeps copies for a set number of days, weeks or months, then removes the oldest. A record that was deleted from the live system 18 months ago may now exist in no backup at all, even though the law expects it to be held for five or seven years.

The second gap is format. A regulator does not want a backup file; it wants the record, readable. If the only copy of an old year's ledger is inside an accounting package you stopped paying for, the record may exist but be unusable (our understanding).

The main retention periods

Three regulators cover most small and mid-sized businesses. Their guidance gives these periods.

Tax records: five years (ATO)

The Australian Taxation Office's overview says: "Generally, the 5-year retention period for each record starts from when you prepared or obtained the record or completed the transactions or acts those records relate to, whichever is later." It adds: "However, in some situations, the law states that the start of the 5-year retention period is different."

The ATO also lists "Records to keep longer than five years", described as "Information for businesses about the records you need to keep for longer than the general 5-year retention period." Examples, in our understanding, include records tied to assets and losses carried forward; check the ATO page for the current list.

Company financial records: seven years (ASIC)

ASIC's company record-keeping guidance states: "Companies must keep financial records for at least 7 years." It notes that "Financial records are defined in the Corporations Act." Its examples include cash records, general ledgers, bank statements, financial statements, tax returns and contracts.

Employee records: seven years (Fair Work)

The Fair Work Ombudsman's fact sheet sets out that employee records must "be in a form that is readily accessible to a Fair Work Inspector", "be in a legible form and in English (preferably in plain, simple English)", "be kept for 7 years" and "not be altered unless for the purposes of correcting an error". Its plain-English page says: "Employers have to keep time and wage records for 7 years."

Other duties

Industry rules, state laws, contracts and court matters can add longer periods (our understanding). A litigation hold, for example, can require you to keep material beyond the usual period; that is covered in a separate guide. Personal information pulls the other way: privacy law expects information no longer needed to be destroyed or de-identified, which is the subject of our guide on personal information in backups.

What the regulators expect of electronic records

All three regulators accept electronic records, with conditions.

ASIC: "Financial records can be electronic. However, you must be able to create hard copies within a reasonable timeframe if you are asked for them."

ATO, format and integrity: "Your records must be in English or able to be easily converted to English." And: "The relevant information in your records must not be changed (for example, by using electronic sales suppression tools ) and must be stored in a way that protects the information from being changed or the record from being damaged."

ATO, encryption: "If you store your data and records digitally using an encryption system – provide encryption keys and information about how to access the data when asked."

ATO, destruction procedures: "You need to keep all information about any routine procedures you have for destroying digital records."

ATO, scanned paper: "We accept images of business paper records saved on a digital storage medium, provided the digital copies are true and clear reproductions of the original paper records and meet our 5 rules for record keeping ."

ATO, cloud storage: if you use cloud storage, "either through your accounting software or through a separate service provider", the ATO asks you to make sure "the record storage meets the record-keeping requirements" and that "you download a complete copy of any records stored in the cloud before you change software provider and lose access".

ATO, backups: the ATO does expect backups as well. Its security page says: "make regular back-up copies of electronic records and store them in a safe place (preferably away from your business premises) or using cloud storage." It also says: "It's vital to have a good back-up procedure for computer files and programs and to have external off-site storage, which may include cloud storage." And the ATO may ask about "your regular back-up and record destruction procedures".

So backups are part of good record keeping in the ATO's view; they are not a replacement for holding the records themselves (our reading).

Why a backup is not a record store

Our reading of the guidance above, set against how backups commonly work:

  • Retention mismatch. Backup retention is usually set in days, weeks or months; record retention is five to seven years from a starting point that differs per record.
  • Deletion carries forward. If someone deletes a record from the live system, each new backup no longer has it. Once the older backups age out, it is gone.
  • Format lock-in. A backup of an application database may only be readable by that application, at that version. Seven years is a long time for software (our understanding).
  • Key loss. Encrypted backups are only readable with their keys; the ATO expects you to provide keys when asked.
  • No index. Finding one employee's timesheets from five years ago inside nightly backups can mean restoring many sets (our understanding).

A practical approach

The following is our recommendation, not regulator wording.

  1. Make a record-type inventory. For invoices, ledgers, payroll, timesheets, contracts and other required records, name the owner, source system, required detail and context, applicable duties, retention periods and their start dates. Ask the responsible adviser to confirm the requirements.
  2. Capture records throughout the year. Decide where each record type is held for its full required period and capture it before deletion, material changes or loss of system access. A year-end export alone can miss records removed or changed earlier.
  3. Reconcile archive coverage. Use software-independent PDF reports, CSV data or other formats where they preserve the required information. Check the exports against the record inventory and source totals, identities and exceptions, including required attachments, transaction detail, corrections and context. No file format alone establishes that the archive is complete. Perform year-end reconciliation as an additional check.
  4. Protect the archive. Keep it where ordinary users cannot change or delete it, and keep a second copy elsewhere.
  5. Keep the keys and instructions. Record how to open the archive, including any encryption keys, in a place your successor could find.
  6. Approve disposal explicitly. A nominal period ending is not permission to destroy records. Obtain documented owner/adviser approval after checking every applicable period and start date, legal hold or order and other continuing duty. Record the decision basis, approved scope and evidence of completed disposal under the written procedure. This guide authorises no disposal.
  7. Before you change provider, export. Follow the ATO's advice to download a complete copy before losing access.

When the clock starts

The start date matters as much as the length. The ATO's general rule runs from the later of when the record was prepared or obtained and when the related transactions were completed, and it notes exceptions. A contract signed six years ago but still running is, in our reading, not yet near the end of its period. For that reason we suggest tagging archive folders by financial year and, for long-running items such as contracts, assets and employees, by the date the matter ended (our recommendation). An archive sorted only by the date files were saved can make records look older than their retention start, which invites early destruction.

Read-only checks

These checks read existing records and settings; they change nothing. The commands are for Windows PowerShell on a file share or archive folder you are allowed to read.

  1. Backup retention. Look up, in your backup settings or contract, how long the oldest copy is kept. Compare it with five and seven years.
  2. Oldest year you can actually open. Pick the oldest year that should still be held. Can you open its ledger and payroll reports today without restoring a backup?
  3. Archive contents by year. On the archive folder, list the oldest files:
Get-ChildItem -Path '\\server\archive' -Recurse -File |
  Sort-Object LastWriteTime |
  Select-Object -First 20 FullName, LastWriteTime, Length
  1. Who can change the archive. Read its permissions:
Get-Acl -Path '\\server\archive' | Select-Object -ExpandProperty Access
  1. Keys and access notes. Confirm that encryption keys and instructions for opening the archive are recorded and that more than one person can find them.

These checks identify candidate records and access settings. File modification dates do not establish a record's retention start or archive coverage. Reconcile completeness separately against the record-type inventory; the rehearsal below tests only the selected records' readability and retrieval time (our recommendation).

Safe restore rehearsal

Once a year, perform a sampled retrieval rehearsal as if a regulator had asked (our recommendation). Choose samples across required record types and periods. Record the sample scope and retrieval time; success does not prove the whole archive complete. Review ongoing capture and reconciliation evidence separately.

  1. Choose a record request: for example, one employee's pay records for a pay period five years ago, or the general ledger for a year six years back.
  2. Retrieve it from the archive, not from a backup, on an ordinary computer.
  3. Open it without the original software where possible, and check it is legible and in English.
  4. Time how long it took and who had to be involved.
  5. Record the sampled results and limitations, investigate gaps promptly and correct capture or reconciliation failures. Do not wait until the next year-end to preserve missing records.

Diagnosing what you find

  • The record is missing: it was deleted before any export; the archive was never created for that year; or it lived in a system nobody listed.
  • The record exists but will not open: it is in a vendor format; the software licence has ended; or the encryption key is lost.
  • The record could have been changed: ordinary users can write to the archive; there is no second copy to compare; or edits are not logged.
  • Retrieval took days: the archive has no year or record-type structure; only one person knows where it is; or the records exist only inside backups.

Worked example (illustrative)

The following is invented. A company with 25 staff uses cloud accounting and a payroll package. Its IT provider keeps 90 days of backups. The finance manager is asked for timesheets from four years ago and discovers the payroll package was replaced two years ago; the old provider's access has lapsed and no export was taken.

The business recovers some records from emailed reports, records what remains missing and asks its adviser how to address the gap. It inventories the required record types, captures them before changes or deletion and reconciles protected exports throughout the year. PDF/CSV formats are used only where they preserve the required detail and context. An annual sampled retrieval checks readability and response time, while completeness is assessed separately. Any later disposal requires the recorded approval and checks described above. This invented response does not establish that the missing historical records were recovered.

Risks and limits

  • This summarises regulator guidance, not the Acts; periods and starting points vary.
  • Other laws, industries and contracts may require longer periods.
  • Keeping records longer than needed can create privacy risk.
  • Not legal or tax advice; confirm with your adviser.

Sources

All accessed 14 November 2026.

Related future topics

  • Deleting personal information that sits in backups
  • Litigation holds and backup retention
  • Year-end export checklists for small businesses

This article was originally published on .