OAIC, APP Guidelines chapter 11: destroy or de-identify personal information no longer needed (APP 11.2) (Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, Chapter 11 (APP 11.2))
A holder that no longer needs records for a permitted purpose must destroy them or ensure they are de-identified. This is a retention duty; it does not itself permit a licence.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Where an APP entity no longer needs personal information for any purpose for which the information may be used or disclosed under the APPs, the entity must take such steps as are reasonable in the circumstances to destroy the information or ensure that it is de-identified.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide