How Long Should Australian Businesses Keep Records Before Shredding Them?
For most Australian businesses, the safest starting point is this: don’t destroy records until the required retention period has ended.
A Certificate of Destruction is one of the most important documents your business can hold after a shredding job. Yet many organisations misunderstand what it actually guarantees. Getting this wrong can leave you exposed during a compliance audit or a data breach inquiry under the Privacy Act 1988 (Cth). Here is a clear-eyed look at what the certificate confirms and, just as importantly, where its limits lie.
A Certificate of Destruction is an official record issued by your shredding provider at the end of each destruction job. It confirms that your confidential materials were collected under chain-of-custody controls and destroyed at a secure facility.
Under the Australian Privacy Principles (APPs), specifically APP 11, organisations must take reasonable steps to protect personal information from misuse and unauthorised access. A properly issued certificate is your evidence that those steps were taken.
A valid certificate should contain the following fields:
| Field | Why It Matters |
|---|---|
| Service provider name and ABN | Identifies who is accountable for the destruction event |
| Collection and destruction date | Establishes a clear timeline for audit purposes |
| Description of materials destroyed | Confirms what category of records was processed |
| Volume or weight of material | Helps verify completeness of the job |
| Chain-of-custody reference | Tracks custody from collection to completion |
| Authorised signatory | Makes the document legally attributable to the provider |
When issued by a reputable provider, a Certificate of Destruction provides verifiable proof of several things:
This is what businesses most often overlook. A Certificate of Destruction is a statement from your provider that destruction occurred. It is not absolute proof that your broader compliance obligations have been met.
The certificate is “not definitive proof” of complete regulatory compliance on its own. It does not cover:
| What a Certificate of Destruction DOES Prove | What It DOES NOT Prove |
|---|---|
| Documents were collected under chain-of-custody controls | That the shredding method matched the sensitivity level of your documents |
| Destruction was completed by the named service provider | That documents were correctly identified before collection |
| Shredded material was disposed of on a specific date | That your internal retention schedule was followed |
| Recycling or waste processing occurred after destruction | That no copies existed in digital or cloud storage |
| Your organisation acted with due diligence under Australian privacy law | That all relevant records were included in the job |
In short: the certificate confirms the end of the chain. It does not validate every step that preceded it.
To make your Certificate of Destruction genuinely defensible, it should sit within a wider information governance framework. This means:
At Hello Shred, we issue a Certificate of Destruction after every job, whether you book a one-off archive cleanout or an ongoing bin service. Our GPS-tracked, background-checked drivers collect your documents under strict chain-of-custody controls and transport them to our secure Kingsgrove facility for certified off-site shredding. All shredded material is then recycled responsibly. Get an instant quote or book your service today and have your compliance paperwork ready before the next audit.
Is a Certificate of Destruction legally required in Australia?
It is not always a statutory requirement, but it is strongly recommended. Under the Privacy Act 1988 and the NDB scheme, organisations must demonstrate that personal information was handled responsibly. Without a certificate, proving compliant disposal is significantly harder during an audit or investigation.
How long should I keep a Certificate of Destruction?
Retain each certificate for at least as long as the records it replaced. Australian retention requirements set five to seven years for most financial, tax, and employee records, so destruction certificates should be held for the same period.
Can an in-house shredder replace a professional service?
An office shredder cannot generate a legally recognised Certificate of Destruction and typically does not meet cross-cut or micro-cut standards. Critically, it provides no chain-of-custody documentation, leaving a compliance gap.
Does the certificate cover digital records or only paper?
A paper Certificate of Destruction covers physical documents only. Digital records, cloud storage, and decommissioned hard drives require separate certified processes. APP 11.2 requires de-identification or destruction across all formats, so both physical and digital destruction records are needed.
For most Australian businesses, the safest starting point is this: don’t destroy records until the required retention period has ended.
A quick burn can feel like the simplest way to clear out old paperwork. Yet for many households and small businesses, the safest approach is mobile document shredding services that destroy information on-site/off-site and leave far less to chance. Burning can create privacy gaps, safety hazards, and a mess of compliance headaches that only show up when it’s too late.
If you’re weighing up a new shredder (or a shredding contract), the micro-cut vs cross-cut shredder question can feel like a technical detail. In a legal or medical setting, it’s rarely “just admin”.
A single page can hold identifiers, case strategy, Medicare details, or notes that should never find daylight. The right cut type reduces the risk of reconstruction, limits who handles sensitive paper, and makes your disposal process easier to defend if you’re audited or queried.
Book online in minutes. Pick your date and
we'll take care of the rest in a single visit.
© 2026 HelloShred | Privacy Policy | Website Designed & Developed by 