So far in 2026, many privacy issues have arisen in an array of diverse arenas: consent, collection, and disclosure in relation to smart glasses; questionable claims to anonymity in relation to pixels and their individuation of website visitors; and updated guidance on facial recognition technology, which enables the collection of sensitive biometric information, however brief. The most exciting is of course the next round of privacy reform, which finds me waiting somewhat impatiently and with a degree of quiet optimism. While the privacy implications of new technologies and reforms are exciting, the foundational aspects of privacy compliance are an ever-present issue and can provide us with something to do while we wait. Emerging technologies effectively compound and exacerbate existing risks in your data holdings rather than necessarily delivering the promised efficiencies and it’s never been a better time, to get ‘your house in order’ so to speak.
The fundamentals of privacy compliance never go out of fashion: knowing your data, implementing practices of data minimisation and proportionality, and arguably the most controversial, deleting data once your organisation no longer has a lawful basis to keep it. All of which will provide a foundation to implement necessary updates to your privacy program when the legislative amendments arrive. Of all the privacy topics, retention tends to be the one left until last (and it is arguably the most polarising). Vendors, new technologies, and internal stakeholders all push for better ways to extract value from data, while privacy professionals caution that privacy-protective approaches are needed — or that it is time to enact time-consuming and technologically complex deletion processes. For privacy professionals and organisations, it can be a headache, because we all know that it is not as simple as scheduling deletion of the data. Yet getting retention right is crucial if we wish to reduce the risks associated with data breach, or secondary use, whilst also avoiding other future problems.
The community has spoken
Over-retention of data is a recurring issue, and as we prepare for the arrival of the ‘fair and reasonable test’ it is time to look at retention from a new perspective. Remember back to June and those end-of-financial-year callouts for donations and seemingly endless deals, which arrive out of the blue each year, from companies and charities you cannot remember ever giving your details to. It raises the question for all of us: how and why do companies still have our data, if we cannot even remember giving it to them in the first place? The long-awaited ACAPS report, delivered in May, confirmed that I am not the only one with these thoughts. The community is tired, and trust in organisations is falling. Privacy policies are too long, and individuals are not reading them — not because they don’t care, but because they feel they have a genuine lack of choice. Concerns over privacy (93% believe protecting personal information is important) are growing. ACAPS 2026 tells us: “Australians feel that when an entity collects their personal information for one reason, it is often not fair or reasonable for them to use it for another purpose.”
It would be easy to dismiss the concerns prominent in ACAPS as only related to emerging technologies, but this is too simplistic a picture. Whilst it is clear that the community is very concerned about the use of their information for AI (93% believing that training AI with personal information collected when providing a product or service is unfair or unreasonable), this is only part of the picture. The broader themes suggest the community feels disempowered, with ongoing and unaddressed concerns, after many have experienced very real privacy harms. Marketing-related concerns are common and growing, particularly being unable to unsubscribe and having information used for unsolicited direct marketing. Notably, 93% of individuals support the right to request data deletion.
It is very clear that the community values privacy, and their concerns are only growing in this digital age. As indicated in the 2026 ACAPS report:
“High support for deletion and concern about secondary uses (including AI training) indicates an expectation that organisations should not repurpose information indefinitely or in ways that are difficult to see, contest or reverse.”
The ACAPS survey tells us that there is a very real ‘trust gap,” especially for data-driven sectors, yet it is a siren song for any organisation that relies on trust. If you are still keeping all the data, perhaps now is the time to listen not just to your security and privacy team but to the community. Would your current practices be considered fair and reasonable? And if the community voice is not enough, the existing regulatory posture reinforces the same message.
The Regulatory context
The words from the Privacy Act, “no longer needs the information for any purpose for which the information may be used or disclosed” followed by “the entity must take steps … to destroy” lead to endless debate about what constitutes a reasonable use and reason for retention, with many organisations drawing a very long, and potentially unlawful, bow. While simultaneously forgetting that APP 11 must be read and implemented in the full context of our privacy regulation which includes requirements for data quality or accuracy (a good reason to delete old data), and overarching principles of data minimisation and transparency. If you would not feel entirely comfortable explaining to the individual from whom the data was collected, why you still have their personal information and what you use it for, the answer seems obvious: you should no longer have the data. And if reaching out to them is difficult because their contact details are no longer accurate, well I think we know the issue here.
Under the reform, we may receive additional clarity although there is still the need for interpretation. Noting proposed changes include the addition of the need to “consider” deletion and additional clauses after the current wording including the need to “take any steps needed to ensure that the APP entity is able to identify personal information to which” APP 11.1 and 11.2 apply and undergo ongoing evaluation of the “effectiveness of its compliance”. So, retaining data because your unaware of your data holdings will be no excuse (if it ever was) and practical mechanisms for ongoing evaluation of retention will be a necessity. The Consultation paper adds that “an entity may decide to retain information in de-identified form where doing so supports its functions or activities, such as research or statistical analysis”. A perspective which should not be read as a green light to hoard data, especially when we consider how tricky, meaningful de-identification can be. Another aspect where new technologies can further exacerbate existing complexities.
The OAIC has already told us that when considering retention or otherwise of personal information, an organisation must actively consider risk and acknowledge that deletion and de-identification can reduce risks to individuals in the event of a breach. The OAIC notes that “in case of ambiguity and with a view to protecting individual privacy, the primary purpose for collection, use or disclosure should be construed narrowly rather than expansively.” Crucially, this regulatory position aligns with what the community itself is asking for. In ACAPS 2026, individuals indicated their support for privacy-by-default settings and identified the key ways organisations should protect data: limiting data collection, deleting data when no longer required, and collecting only what is needed.
While not a definitive precedent or explicit endorsement by the OAIC, the recent preliminary findings into the 2025 Qantas breach offer an illustrative example of how an organisation has taken a considered and documented approach to what “reasonable” retention might look like in practice under APP 11.2. A defined retention period (seven years) tied to last customer interaction, a documented exception process for legitimate ongoing business needs, at least annual scheduled deletion, a dedicated privacy function overseeing it, and an ad hoc deletion channel for customer requests. In advice advice directed at charities, Commissioner Carly Kind identified that some organisations were retaining personal information from just a single donation, indefinitely, long after individuals had stopped engaging with the charity, and far beyond what would be considered sensible. The article highlighted the risks to charities and their supporters when data is kept beyond what is reasonable and suggested a seven-year baseline as a threshold beyond which retention would be called into question if those supporters were no longer considered to be engaging with the charity. This is a useful guide for any entity not subject to state or commonwealth records provisions.
Action required
One purchase, donation, or browse should not put us on a marketing list for life. The community agrees with this notion; the OAIC agrees. So why are organisations still holding on to our data? Perhaps spring can be the time not just to smell the flowers, but to clean house and meaningfully tackle retention.
If your executive remains unconvinced, consider the underlying culture of your organisation: do you rely on reputation or competitive edge? Do you fear public sentiment or regulatory penalties? Once you have identified those drivers, a considered life-cycle approach to privacy — including retention — can be presented (with ACAPS statistics) providing an evidence-based perspective on what the community wants, supporting privacy as a way of gaining competitive edge and community support. Look for references to aged data holdings in regulatory decisions (and how this influences actions taken or not taken) as further cautionary evidence of the need to act. As well as the proposed changes which highlight the need for meaningful governance and ongoing vigilance. When implementing your approach, consider the following (which will give you a solid basis for current and future compliance with APP11):
- Set explicit maximum retention periods per data type, tied to an actual business or legal justification (not a generic policy statement).
- Build an active destruction/de-identification process. A policy without an operating mechanism is not compliant. You cannot have a retention policy without a way to honour its intentions.
- Treat data age as a rising risk factor, not a reason to deprioritise cleanup.
- Ensure contracts with vendors require deletion at contract end and are reviewed periodically.
- Periodically audit retention practices, including for third-party and vendor-held data (a mechanism to get in the habit of “regularly evaluat[ing] effectiveness” of your compliance).
- Train staff on retention/destruction procedures and assign clear ownership.
- Consider adopting a concrete numeric ceiling (the seven-year figures used in both the Qantas and charities examples are illustrative, not universal, but link to key legislative provisions and therefore act as a meaningful benchmark) as a practical starting point, provided it is actively enforced.
- Ensure all staff are aware of appropriate collection, use, and retention; you cannot collect additional data or retain data for AI uses without meeting other lawful requirements, no matter how tempting.
Over-retention may not be as glamorous, or as obvious, as the privacy risks that are beginning to become apparent with emerging technology, or as exciting as privacy reform, but in 2026 the message that underlies many aspects of privacy, from both the regulator and the community, is unmistakable: the organisations that earn trust are the ones that know when to let go of data, not the ones that hold on to it indefinitely. If you have not reviewed your retention practices recently, now is the time. And if in doubt, throw it out (just as long as you have met all other legal retention requirements)!
