The privacy regulator issued a statement on 25 September confirming its investigation into the 2023 Latitude breach is still running, three and a half years on. There are no findings yet and the OAIC will not comment until it concludes. But the published scope of the investigation is worth a small business owner’s attention, because it covers two things, not one. Whether the data was protected. And whether data that was no longer needed had been destroyed. Data retention is the second question, and it is the cheaper one to get right.
What the OAIC says it is examining
The Commissioner-Initiated Investigation began on 10 May 2023, and a representative complaint was accepted in February 2024. The stated scope is whether Latitude took reasonable steps to protect the personal information it held, and whether it destroyed or de-identified information it no longer needed. Nothing is substantiated. No contravention has been found. It is an open investigation and should be read that way.
The numbers that make the second limb interesting are not in dispute, because Latitude published them itself. In Latitude’s own update at the time, the company reported roughly 7.9 million Australian and New Zealand driver licence numbers taken, plus about 53,000 passport numbers. It also reported a further 6.1 million customer records dating back to at least 2005 — and that about 94 per cent of those, some 5.7 million, had been supplied before 2013.
Sit with that figure. The overwhelming majority of the records exposed had been collected more than a decade earlier. Whatever the investigation eventually finds about the security controls, the scale of the harm was decided years before the attack, by a decision nobody remembers making: keep everything.
Why data retention is the control a small business can afford
Most security advice costs money on an ongoing basis. Monitoring, endpoint tools, audits, training. A twenty-person business cannot out-spend a determined attacker on detection, and pretending otherwise is how security budgets get set by anxiety.
Deletion is different. It is the one control that reduces your exposure permanently and costs nothing to maintain. A record you no longer hold cannot be stolen. It does not need encrypting, backing up, access-controlling or including in a breach notification. It will not turn up in a discovery request. The work is one afternoon, and the benefit does not expire.
It also shrinks the worst day. The difference between notifying two hundred people and twenty thousand is rarely the quality of anyone’s firewall. It is how much was sitting there.
What you actually have to keep
The honest objection is that you cannot just delete things, and that is true. Some retention is legally required. The ATO’s general rule is five years from when the record was prepared, obtained, or the transaction completed, whichever is latest. Fair Work requires time and wages records to be kept for seven years. For most employers the practical answer is to work to seven and stop trying to run two clocks.
But notice how narrow those obligations are. They name specific categories of record. They do not say keep every export, every attachment, and every copy forever.
The material that actually accumulates in a small business is almost never the ledger. It is the loose stuff around it:
- CSV exports sitting in someone’s Downloads folder from a reporting job in 2022.
- Form submissions stored inside a website plugin nobody has opened since it was set up.
- Spreadsheets of leads and enquiries from campaigns that ended years ago.
- Identity documents emailed during onboarding and never removed from the mailbox.
- Backups of a system you stopped using, kept because deleting a backup feels reckless.
None of that is required by the ATO or anyone else. All of it is in scope if you are breached.
Whether the Privacy Act even applies to you
Here is the part that gets misreported constantly. The APP 11.2 destruction obligation sits in the Privacy Act, and the Privacy Act still does not apply to most small businesses. The general threshold remains $3 million in annual turnover, and the 2024 amendments left the small business exemption in place. Removing it remains a proposal for a second tranche of reform, not current law. Be sceptical of anyone telling you otherwise.
Some businesses are covered regardless of turnover, including private health service providers and businesses that trade in personal information. From 1 July 2026 that extends to reporting entities under the expanded anti-money-laundering regime, which pulled in many accountants, conveyancers and real estate agents for the first time.
If none of that catches you, the obligation does not apply. The risk still does. Your customers do not check your turnover before deciding how they feel about their licence number being posted online, and neither do the people who take it.
A retention pass you can do in an afternoon
Not a project. A list and two decisions:
- Write down every place customer or staff personal information is held. Include mailboxes, the website, the accounting package, cloud drives and old laptops.
- For each one, ask what the oldest thing in it is, and why it is still there. “Nobody has looked” is the usual answer and a perfectly good reason to act.
- Separate what is legally required to be kept from what is merely still present. That line is much further left than people expect.
- Delete the second category, or de-identify it if you want the aggregate numbers. Old sales totals do not need names attached.
- Write down the rule you just applied, in one or two sentences, so the next person does not start the pile again.
That last step is what makes it stick. A one-off clean-up buys you a year; a written rule keeps working. If you are not sure what you hold or where it lives, that inventory is the first thing a data health check produces. It is worth doing before you spend money protecting data you never needed to keep.