| A data retention policy sets what information your business keeps, why it needs it, how long it is held, when that period starts and what happens when it ends. It also names who approves disposal and when deletion must pause. |
A director asks for the file on a job the company finished six years ago. It was on a server that has since been replaced, and nobody is certain which parts came across. The same business still holds the CVs of past applicants and a shared folder of old staff details, because nobody ever decided what to keep or who could dispose of it.
Some records have minimum legal periods. Personal information also needs a continuing lawful purpose. The practical task is to turn those decisions into rules your systems and staff can follow, including copies held in email, shared drives, cloud applications and backups.
How long must NZ businesses keep records?
There is no single period for every business record. IRD requires tax records to be kept for at least seven tax years, wages, time, holiday and leave records have a six-year minimum, and company records and sector obligations need their own checks. A data retention policy that writes seven years against everything is a starting point, not a schedule.
| Record category | Starting guidance | Clock and checks |
|---|---|---|
| Tax and supporting business records | At least 7 tax years (IRD) | Identify the relevant tax period and any reason to keep records longer. |
| Specified company records | Many listed records 7 years (Companies Act 1993, section 189) | Use the exact category. Current constitutions, registers and other standing records are not disposed of on a blanket seven-year rule. |
| Wages, time, holiday and leave records | At least 6 years (Employment NZ) | Record the applicable record date, and check whether overlapping tax duties require longer retention. |
| Personal information without another fixed duty | Only as long as required for a lawful purpose (Principle 9) | Document the purpose and the review or expiry trigger, then check holds and other obligations. |
For each category, record the period and the event that starts it. A file’s last-modified date is not a substitute for the relevant tax period, record date or other agreed event. Records that serve several purposes need every applicable obligation considered, and holds, requests and continuing lawful purposes are checked before disposal is approved.
The table is a starting point rather than a complete legal schedule. Your business and its advisers approve the periods, purposes and exceptions; Exodesk applies the agreed requirements to the systems that hold the records.
Why does a data retention policy matter?
Privacy Principle 9 says personal information must not be kept for longer than is required for the purposes it may lawfully be used for. The test is the continuing lawful purpose, not the age of the record. An old customer file can still be needed, and a recent one may have no purpose left. Keeping everything indefinitely without a reason is not a sound alternative.
A data retention policy also reduces what is exposed if something goes wrong. It cannot remove breach risk, and a breach does not automatically expose every stored record. Whether people must be notified depends on what was affected and whether the breach is likely to cause serious harm under the Privacy Act.
Employment records carry specific penalties. A Labour Inspector can issue infringement notices of $1,000 per record-keeping offence, up to $20,000 in a three-month period, and the Employment Relations Authority can order penalties of up to $10,000 per breach for an individual employer and up to $20,000 per breach for a company. Which applies depends on the breach.
What should the retention schedule contain?
The schedule is the working part of a data retention policy. For each record category, write down:
- Purpose and authority. Why the records are kept and the law, contract or business need behind them.
- Period and trigger. How long, and the event that starts the clock.
- Systems and copies. Where the records live, including email, shared drives, applications, exports and backups.
- Owner and approval. Who owns the category, who approves disposal and the method used.
- Exceptions. Requests, disputes and legal holds that pause deletion.
- Checks. How implementation and retrieval will be confirmed.
For example, a tax-record row identifies the tax period, the adviser-confirmed retention rule, the accounting system and its exports, who authorises disposal and how holds are checked. A backup row records its actual coverage and expiry. Neither row is complete with just seven years written beside it.
Who owns the data retention policy?
A data retention policy needs a named owner, ideally someone with authority over records and privacy, who keeps the schedule current and decides disputed questions. Each record category then has an owner who knows how the records are used and approves disposal for that category.
- Policy owner. Keeps the schedule current, approves changes and confirms adviser input on periods and exceptions.
- Category owners. Confirm the purpose, trigger and systems for their records, and approve disposal for their category.
- Privacy officer. Checks personal information against Principle 9 and handles access and correction requests.
- IT. Applies the agreed settings, reports failed actions and keeps evidence of what was retained or deleted.
Separating approval from implementation matters. The people who apply retention settings are not the people who decide what may be destroyed.
How do legal holds and requests work?
A legal hold pauses routine disposal for records that may be needed for a dispute, investigation, complaint or other obligation. Access and correction requests under the Privacy Act can also require information to be found and kept while the request is handled. The data retention policy should say who can place and release a hold, how it reaches the system owners, and how automated deletion is stopped for the records in scope.
Record when a hold starts and ends, which categories and systems it covers, and who confirmed release. Once released, the records return to their normal schedule rather than being kept indefinitely by default.
Can a backup meet a retention requirement?
Possibly, if the arrangement preserves the required records and versions for the full period and lets you retrieve usable information when needed. A ninety-day backup setting will not preserve a version for seven years. That is a limit of the setting, not of every backup product, and some backup services offer long retention with granular recovery.
Backups support recovery. Retention rules govern how long information must or may remain. An archive can improve long-term organisation and retrieval, but a separate archive product is not required in every case, and Microsoft 365 can retain content in place so it does not have to move to separate storage. Check coverage, integrity, access, search and readability rather than relying on the label on the service, and state in the data retention policy which backups count towards a retention period. Our backup as a service sets coverage and retention as part of the agreement.
Archive storage is not automatically cheap once retrieval, indexing and access costs are included. Exports to PDF/A or CSV can help for suitable records but may lose attachments, relationships or metadata, so keep the context needed and check retrieval at a frequency suited to the risk.
Where should retained records be stored?
A data retention policy names where each category lives once it leaves daily use. Use a system that meets the agreed access, retention, integrity and retrieval requirements. That may be an existing platform or a separate archive. Compare storage and retrieval costs, security, formats, holds, disposal and exit options before moving anything.
Hosting in New Zealand or Australia does not by itself settle compliance. For tax records stored offshore, including in cloud services, IRD requires approval held by you or your cloud provider. For personal information, check how the provider handles it, the contract and security terms, and how you would get the records out at the end. Our NZ Privacy Act compliance guide covers overseas disclosure in more detail.
What happens when somebody leaves?
Restrict the person’s access promptly through your offboarding process. Then decide what business information must remain, who may access it and how it will be preserved. Shared, inactive and exported mailboxes have different access, hold and licensing implications, so exporting every mailbox is not a universal data retention policy.
In Microsoft 365, making a mailbox inactive requires the correct licence and a hold applied before the account is deleted. An export is not automatically complete, searchable or subject to the original controls. Verify preservation before removing a licence or deleting an account. Where the work involves moving mailboxes, our email migration service plans the preservation first.
How do you dispose of records securely?
The data retention policy names the disposal method for each category. Use a sanitisation method suited to the media and the sensitivity of the information. Overwriting is not a universal answer for solid-state drives, and ordinary delete behaviour varies with storage and encryption. NIST SP 800-88 Rev. 2, published in September 2025, supports a documented and verified sanitisation programme. A destruction certificate records the process; it is not automatic proof of every claimed outcome. For retired laptops, servers and drives, our secure IT disposal service records each device through to its result.
Document residual copies and when backup recovery points expire. Selective deletion from backups is not possible in every system, so record the restrictions on restored data instead. If a wider restore brings expired information back, reapply the retention decision and check it before release. Before any routine disposal, check for requests and legal holds, and pause the category while the responsible person resolves the scope.
How do you put the policy into practice?
Inventory the systems and copies first. Group the records, confirm periods and triggers, then assign owners and disposal approval. Test the available controls on one reviewed category before wider rollout, confirm what would be retained or deleted, and verify the outcome.
Microsoft 365 retention policies and labels differ by workload and licence, and features such as event-based retention, auto-labelling and disposition review are not included in every plan. Automation can retain as well as delete, and copying data out of Microsoft 365 may change which controls follow it. Give the data retention policy an owner, monitor exceptions and failed actions, and review it when systems change.
Retention sits alongside other controls: data loss prevention limits inappropriate sharing, and managed IT services keep the agreed settings maintained.
When should the policy be reviewed?
Review the data retention policy on a set cycle, such as annually, and whenever systems, services or obligations change. A new application, a platform migration or a change to the law can each leave a category without the right setting. Check a sample of categories to confirm that what the schedule says matches what the systems actually retain and delete, and record the review date and any changes approved.
Data retention support from Exodesk
Exodesk can help apply agreed retention decisions to your Microsoft 365 environment, storage and backup arrangements. Your business and advisers approve the periods and exceptions; we scope the technical settings, checks and ongoing responsibilities.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
NEXT STEP
Ready to put your retention schedule into your systems?
Tell us which systems hold your records and what your advisers have approved, and we can scope the Microsoft 365 retention settings, holds and checks. Please keep personal records and passwords out of the enquiry form.
Or see how backup as a service handles recovery and retention.
Frequently Asked Questions
What is a data retention policy?
A data retention policy sets what information a business keeps, why, for how long, when that period starts and what happens when it ends. It names who approves disposal and when deletion must pause. It applies to every copy, including email, shared drives, cloud applications and backups.
How long do NZ businesses have to keep records?
It depends on the record. IRD requires tax records to be kept for at least seven tax years, and wages, time, holiday and leave records have a six-year minimum, with longer periods possible where tax or other duties overlap. Company and sector records need their own checks, so record the period, trigger and exceptions for each category.
Is keeping old personal information a Privacy Act breach?
Age alone does not decide that. Principle 9 requires personal information to be kept no longer than needed for the purposes it may lawfully be used for. Review the purpose, applicable duties and any preservation requirements, and dispose of information with no continuing lawful purpose through the approved process.
How long should unsuccessful job applications be kept?
There is no general six-to-twelve-month rule for every NZ employer. Privacy Commissioner guidance says to securely destroy unsuccessful applications unless the applicant has given prior consent to keep them for another opportunity. Resolve any separate legal preservation need with an adviser and record the purpose and review date.
How long should CCTV footage be kept?
Use a period justified by the purpose and circumstances rather than a universal number of days. Restrict access and delete footage routinely when it is no longer needed. Preserve relevant footage when an incident, request or other obligation requires it.
Can a backup satisfy a seven-year retention requirement?
It can contribute if its actual coverage, retention, record integrity and usable retrieval meet the requirement. A short backup cycle does not. Check the record and version required, how it is found and read, access, holds, disposal and exit arrangements, since a separate archive can help but is not automatically compulsory.
What should happen to a former employee mailbox?
Remove the person from sign-in through offboarding, then preserve the business records and give authorised access to those who need it. The method depends on requirements and licensing. Confirm preservation and holds before removing licences or deleting accounts.
Can NZ business records be stored overseas?
In many cases, with the relevant requirements met. For tax records stored offshore, including in cloud services, IRD requires approval held by you or your provider. For personal information, check how the provider handles it and apply the relevant safeguards, because hosting in NZ or Australia does not by itself settle compliance.
How do you delete business data securely?
Match the method to the application, media and sensitivity. Check provider deletion and recovery layers, use an appropriate sanitisation or destruction process for physical media, and record the result. Routine delete or a generic overwrite claim is not enough for every device.
What happens to deleted records in backups?
Copies may remain until the relevant recovery points expire. Record the coverage, retention, access restrictions and how expiry works. If a broader restore brings expired information back, reapply the retention decision before routine use.
What should a data retention policy include?
It should list each record category with its purpose and authority, retention period and start trigger, systems and copies covered, owner, disposal approver and method, and the exceptions that pause deletion. It should also say how holds are placed and released and how the policy is reviewed.
When should a data retention policy be reviewed?
Review it on a set cycle, such as annually, and whenever systems, services or obligations change. Check a sample of categories to confirm the systems retain and delete what the schedule says. Record the review date and any approved changes.
What is a legal hold?
A legal hold pauses routine disposal for records that may be needed for a dispute, investigation, request or other obligation. The responsible person confirms the scope, communicates it to the system owners and releases it when it ends. Routine deletion for that category stops until then.
Is a data retention policy a legal requirement?
Record-keeping and privacy obligations apply whether or not a written policy exists. A written schedule helps the business apply them consistently and show how decisions were made. Some sectors also have their own governance requirements to check.
Contact us or call 0800 396 337 to discuss implementing your data retention policy.
