About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.
A customer closes their account. Months later, the business's retention policy says their details are no longer needed, and someone deletes the record. The live system is clean. But the nightly backups from the last 30 days still hold the record, the monthly copies hold it for a year, and an old archive disk in a cupboard holds it indefinitely.
Australian privacy guidance treats those copies as part of the same duty. This guide is for privacy officers, business owners and the people who run their backups. It explains what the Office of the Australian Information Commissioner (OAIC) expects under Australian Privacy Principle 11.2, how "beyond use" applies to backups, and what to design so that a restore does not quietly undo a deletion. It is general information, not legal advice.
Why it matters
The OAIC's view is that holding less reduces harm: "retaining too many categories of personal information can increase the harm to an individual in the event of a data breach or unauthorised access. Retaining a high volume of personal information can also amplify the reputational and financial risks to the APP entity."
The duty runs both ways, though. The same chapter treats losing information as a security failure, including when an entity "electronically loses personal information, such as failing to keep adequate backups of personal information in the event of a systems failure." So the answer is not to stop backing up. It is to back up what you need, for as long as you need it, and no longer (our reading).
Backups are often the largest and least-reviewed store of old personal information a business has (our reading). They are also attractive in a breach: one stolen backup can hold years of customer records.
What APP 11.2 requires
The OAIC summarises the duty: "Where an APP entity no longer needs personal information for any purpose for which the information may be used or disclosed under the APPs, the entity must take such steps as are reasonable in the circumstances to destroy the information or ensure that it is de-identified."
It expects action rather than waiting: "It is expected that an APP entity actively considers the privacy and security risks of any personal information it retains, and actively seeks to mitigate these risks by taking reasonable steps to destroy or de-identify personal information that is no longer needed."
It covers backups
The guidance is explicit: "Where an organisation holds personal information that needs to be destroyed or de-identified, it must take reasonable steps to destroy or de-identify all copies it holds of that personal information, including copies that have been archived or are held as back-ups."
"Holds" is wider than possession. The OAIC says the obligation "applies even where the organisation does not physically possess the personal information, but has the right or power to deal with it." In our reading, that brings backups kept by a provider on the business's behalf into scope.
When it does not apply
The duty does not apply where information must be kept: "If an organisation is required by or under an Australian law or a court/tribunal order to retain personal information, it is not required to take reasonable steps to destroy or de-identify it (APP 11.2(d))." Tax, company and employment records with legal retention periods are examples (our understanding; see our guide on Australian record retention). For agencies, Commonwealth records follow the Archives Act instead.
Not every business is an APP entity; some small businesses are outside the Privacy Act (our understanding). Check whether the Act applies to you before relying on this guide.
What "reasonable steps" means
The OAIC says the steps "will depend upon circumstances that include: the amount and sensitivity of the personal information — more rigorous steps may be required as the quantity of personal information increases, or if the information is ‘sensitive information’".
The steps "include both technical and organisational measures (APP 11.3)". Its examples of organisational measures include "staff training, policies and procedures to determine if personal information needs to be retained, destroyed or de-identified, and verifying and documenting when and what personal information is destroyed or de-identified."
"Beyond use": the backup answer
Destroying one customer's record inside a backup set is often hard. Many backup formats store data in blocks or containers shared with other records, and removing one record can mean rewriting or invalidating the whole set (our understanding).
The OAIC anticipates this. Its security guide says: "Where it is not possible for an entity to irretrievably destroy personal information held in electronic format, reasonable steps to destroy it would include putting the personal information ‘beyond use’." Its example is "where technical reasons may make it impossible to irretrievably destroy the personal information without also irretrievably destroying other information held with that personal information".
Information is beyond use, in the OAIC's words, if you:
- "are not able, and will not attempt, to use or disclose the personal information"
- "cannot give any other entity access to the personal information"
- "surround the personal information with appropriate technical, physical and organisational security."
It adds: "This should include, at a minimum, access controls including logs and audit trails, and commit to take reasonable steps to irretrievably destroy the personal information if, or when, this becomes possible."
And it sets expectations: "It is expected that only in very limited circumstances would it not be possible for an organisation to destroy personal information held in electronic format."
Short retention is not a beyond-use safe harbour. The privacy/legal owner should document why irretrievable destruction is not possible in the circumstances, assess whether de-identification is appropriate and reasonable, and verify every beyond-use condition above. Inconvenience or some cost alone is not an exemption. Ordinary restricted restore permissions do not by themselves show an inability to use, disclose or give others access. Technical safeguards must prevent the affected information being exposed through restores, with a commitment and process to destroy it when possible.
De-identification instead of destruction
APP 11.2 allows de-identification as well as destruction. The OAIC's guide quotes the Privacy Act test: information is de-identified "if the information is no longer about an identifiable individual or an individual who is reasonably identifiable". It also warns you to consider "the risk of re-identification".
For backups, de-identification is rarely practical in place, because the backup copy cannot usually be edited (our understanding). It is more useful earlier: if a live system keeps statistics rather than names for old enquiries, the backups taken after that point hold less personal information to begin with (our recommendation).
Designing backups so the duty can be met
The following is our recommendation, built on the OAIC's expectations.
1. Keep backup retention short and known
Keep retention no longer than justified by recovery and other applicable duties. A configured expiry is a planned event, not evidence that information has disappeared. Record planned expiry separately from verified disposal, and track provider copies, exports, held or locked sets, failed expiry jobs and other exceptions. Check evidence of completed disposal across the relevant copies; reconcile holds and retention locks with the privacy/legal owner rather than bypassing them. A short schedule does not itself meet the beyond-use test.
2. Separate legal archives from operational backups
Records you must keep by law belong in a defined archive with its own retention. Operational backups then need only cover recovery, not years of history.
3. Lock down old backup copies
Restricted access and restore logs are safeguards, not the whole beyond-use test. For information assessed as beyond use, design and verify controls that prevent its use, disclosure or exposure to other entities, including through recovery. Have the privacy/legal owner approve the assessment and the qualified operator validate the safeguards in an isolated test.
4. Stop restores bringing deleted data back
A restore of an earlier database can reintroduce subsequently deleted records. Maintain a current, protected deletion register separately from the older backups it governs, using the minimum identifiers and decision evidence needed. It must survive a restore of the application itself. Apply approved deletions to the restored copy in quarantine and verify the affected records remain absent before release; do not expose them to ordinary users while reconciling the register (our recommendation).
5. Check providers and old media
The OAIC's guide asks you to consider whether the provider will "also backup your personal information holdings and if so what data will be captured". It also says that where information is held "on a third party’s hardware, such as cloud storage", and the organisation has asked the third party to de-identify it, reasonable steps "would include taking steps to verify that this has occurred."
Old disks, tapes and exported files are copies too. List them and decide each one's fate.
Read-only checks
These checks read settings and records; they change nothing.
- Backup retention. From your backup settings or provider contract, record how long each kind of backup is kept, and whether any copy is kept indefinitely.
- Old copies. List every place a backup or export might live: cloud storage, external disks, tapes, former staff laptops, a previous provider.
- Deletion and disposal register. Distinguish approved live-system deletion, planned backup expiry, verified disposal evidence and outstanding exceptions. Confirm the current register is protected independently of older application backups and accessible to the authorised recovery team.
- Restore access and logs. Check who can restore, and whether restores are logged.
- Database copies on Windows. On a Windows file server, using PowerShell, look for stray database or export files that may hold personal information:
Get-ChildItem -Path 'D:\' -Recurse -File -Include *.bak,*.csv,*.xlsx,*.accdb -ErrorAction SilentlyContinue |
Select-Object FullName, LastWriteTime, Length
This finds candidates only; it does not tell you what is inside them (our recommendation). Read access to the drive is needed.
Safe restore rehearsal
This untested rehearsal checks the deletion controls for a synthetic record, not legal compliance for every copy. Use an authorised isolated test system and no real customer records.
- Create a synthetic record, take a test backup, then perform its approved deletion and add the decision to the separately protected current deletion register.
- Restore the earlier backup in quarantine, with no ordinary user access. Obtain the current register from its independent protected location, not from the older restored application.
- Reapply the approved deletion before releasing the test system. Check the synthetic record is absent from the restored data and ordinary application views, and record the checks and limitations.
- Verify disposal separately. Inspect completion evidence for the selected test backup and relevant copies when their approved retention ends. Record failures, locks or holds as outstanding; the date alone is not proof.
- Record what the rehearsal demonstrated and obtain the privacy/legal owner's review of any unresolved beyond-use or disposal condition.
Diagnosing what you find
- Deleted records reappear after a restore: no deletion register exists; the restore procedure does not include re-applying deletions; or deletions were done by hand and not recorded.
- Nobody knows how long backups last: the provider sets retention; settings were never reviewed; or several backup tools are in use.
- Old copies turn up: a previous provider still holds data; staff exported data to spreadsheets; or decommissioned disks were never sanitised.
- Restores are not logged: the backup tool does not log by default; restore rights are shared accounts; or logs are kept too briefly to be useful.
Worked example (illustrative)
In this invented scenario, a clinic's privacy/legal owner approves deletion of a defined class of enquiry records after checking applicable obligations; the example sets no retention rule for clinics generally. Its backup schedule plans expiry after 35 days. The register records that planned date, actual disposal evidence and unresolved provider or locked-copy exceptions separately. No item is marked destroyed merely because 35 days passed.
A rehearsal uses synthetic enquiries and a current deletion register protected outside the old application backup. The team restores in quarantine, reapplies the approved deletions and verifies that the synthetic record is absent before any user access. It separately checks evidence for an authorised disposal of a test export. The result supports those tested controls only; any remaining copies or beyond-use conditions stay open for the privacy/legal owner.
Risks and limits
- The OAIC is updating Chapter 11; check the current page.
- Original drafting used archive copies. The correction uses saved primary-page public-web material from the independent review; it is not an all-jurisdiction legal audit.
- Whether the Privacy Act applies, and what is reasonable, depends on your circumstances.
- Not legal advice.
Sources
Primary-page material was captured through public web access during independent review on 14 November 2026 and reread for correction. The original writer used archive copies.
- OAIC, Chapter 11: APP 11 Security of personal information (updated 3 October 2025): https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information
-
OAIC, Guide to securing personal information: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-securing-personal-information
-
OAIC, Small business: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business
Related future topics
- Australian record retention periods and archives
- Restore procedures that re-apply deletions
- Sanitising old backup media
This article was originally published on .