Can data be retained beyond the 7-year minimum?
Yes - the business can override the minimum to a longer retention period on customer request, useful for litigation holds and long-term clients.
Scenarios where extended retention might be valuable:
- Litigation hold - where a matter is subject to ongoing legal proceedings and records are needed for evidence.
- Long-term client relationships - where the firm wants to preserve CDD evidence beyond the regulatory minimum for operational reasons.
AUSTRAC's framework specifies a minimum retention period of 7 years; firms can retain longer if there's a legitimate need, subject to Australian Privacy Principles (which expect personal information to be deleted when it's no longer needed for the purpose it was collected for).
If a customer has a specific extended-retention requirement, raise it with the customer success team - it's likely to be supportable but the legal position needs to be confirmed before commitment is made on a per-customer basis.