The OAIC’s data breach figures for the first half of 2026 came out on 26 October: 667 notifications, up from 662. Breaches affecting more than a million people went from 4 to 11, as techpartner.news reported.
Most of the coverage stops there. The line I’d keep is from the Commissioner, in the OAIC’s release: “Organisations can’t lose personal information they don’t hold.”
Most security work costs money. Deleting things mostly costs an afternoon.
What you’re probably keeping without thinking
“We keep everything because we might need it” is what I hear, and I understand it. Storage is cheap and nobody gets in trouble for keeping a file. So these pile up:
- Bank details for a contractor you last paid in 2019
- Scans of licences and passports from old onboarding
- Job applications from people you didn’t hire
- A spreadsheet of former customers, exported from a system you’ve since replaced
- Attachments sitting in a shared mailbox
- The laptop of someone who left, still in a cupboard
None of it earns anything. All of it comes out in a breach, along with whatever you still need.
What the law says about deleting
If the Privacy Act covers your business, deleting is an obligation. Once you no longer need personal information for a permitted purpose, you must take reasonable steps to destroy it or de-identify it. The OAIC’s guidelines say that covers archived copies and backups too. They also say holding what you don’t need can increase the harm to people if there’s a breach.
If you’re under the $3 million threshold, that general rule probably doesn’t apply to you, but check the exceptions that catch people out. Tax file numbers are a separate matter: the TFN Rule applies to anyone holding them, and requires you to securely destroy or de-identify them once you’re no longer required to keep them. If you’ve employed anyone, you’ve held them.
And whatever the law says about you, a leak of old records lands on the same people in the same way.
What you have to keep first
This is where “delete everything old” goes wrong, because some of it you’re required to hold:
- Most business and tax records: 5 years, says the ATO, and some for longer.
- Company records: the ATO notes that ASIC requires companies to keep records for 7 years.
- Employee records: 7 years, says the Fair Work Ombudsman.
Your industry may add its own rules, and anything tied to a live dispute or claim stays put. Ten minutes with your accountant before you start is well spent.
The aim is a date against each kind of record. Keep it until then, for a reason you can name.
An afternoon’s work
List where it lives. Your accounting and job systems, shared drives, email, old laptops, and whatever is on someone’s desktop. The spreadsheets matter more than the systems, because nobody controls who copies them.
Ask two questions of each pile. What do we use this for, and when does that end? If nobody can answer the first one, it’s a candidate to go.
Delete it properly. Empty the recycle bin and the “deleted items” folder as well, and wipe old laptops before they leave the building. Backups are harder, because you usually can’t pick one record out of them. Set how long backups are kept, write that down, and let the old copies age out. If you’re not sure what your backups hold, start here.
Stop it coming back. This is the part most people skip. Do you need a copy of that licence, or only to sight it and note the date? Collect less and there’s less to clean up next year.
Put a date in the calendar. Once a year is plenty for most businesses. The second time takes far less work.
Why deleting data reduces breach risk
Deleting personal information you no longer need reduces the harm a data breach can do, because attackers can only take what’s still there. Australia’s privacy regulator made the point when it released its January to June 2026 figures, which showed 667 breach notifications and malicious attacks as the leading cause. Under Australian Privacy Principle 11.2, a business covered by the Privacy Act must take reasonable steps to destroy or de-identify personal information once it’s no longer needed, including archived and backup copies, unless a law or court order requires it to be kept. Common retention periods are 5 years for most tax records and 7 years for employee records. A small business can usually work through this in an afternoon: list where personal information is held, name the purpose and end date for each kind, delete what’s past that date, and stop collecting what it doesn’t need.
Next step
Try the list on one shared drive and see what turns up. If you find more than you expected, or you’re not sure what you’re obliged to do, get in touch. I’ll go through it with you, and I’ll say so when you need a privacy lawyer instead. There’s more on how I do this under risk and obligations.
General information only, not legal advice. Your privacy lawyer or accountant can tell you what applies to your business.