Chat Transcript Retention in Australia: How Long to Keep Them
No single law sets how long Australian businesses must keep chat transcripts. Learn what APP 11 requires, how to set a schedule, and how to secure the data.
There is no single Australian law that says how long you must keep customer chat transcripts. The Privacy Act 1988 sets no fixed period. It requires you to destroy or de-identify personal information once you no longer need it, unless another law, a court order or a records authority says otherwise. In practice, your retention period is a documented decision: the shortest time that covers your business purpose, your sector rules and your legal exposure.
This guide shows how to make that decision, what the regulators say, and how to build a schedule your IT, legal and operations teams can defend.
TL;DR
- No national statute prescribes a retention period for customer-service chat transcripts. The Privacy Act sets no period and ties disposal to when the purpose ends.
- Under APP 11, you must take reasonable steps to destroy or de-identify personal information you no longer need, unless a law or court order requires you to keep it.
- Sector rules, public-sector records laws and litigation risk can lengthen the period. Write down the reason for each period you choose.
- Telecommunications metadata retention rules are a separate scheme and do not govern your chat transcripts.
- Store transcripts with access controls, encryption, secure backups and logging, and keep personal data onshore if sovereignty matters to your customers or regulator.
Table of Contents
- Is there a legal retention period for chat transcripts in Australia?
- What the Privacy Act requires under APP 11
- AI chat adds extra obligations
- Do sector and public-sector rules change the answer?
- Chat transcripts are not telecommunications metadata
- Recording consent still matters
- How to set a retention schedule you can defend
- Securing the transcripts you keep
- Where the data lives matters
- Our perspective
- Put retention rules into your chat platform
- FAQ
- Sources
Is there a legal retention period for chat transcripts in Australia?
No. State Records NSW notes there is no single source detailing how long records should be kept. Retention and disposal authorities set periods only for the organisations and record types they cover.
That leaves most private-sector teams in a grey zone. A chat transcript is rarely a regulated record in its own right. It becomes one depending on what it contains and why you hold it:
- A transcript that forms part of a financial transaction record may fall under financial services or tax record-keeping rules.
- A transcript that documents a complaint may need to be kept for as long as the complaint, and any external dispute process, can run.
- A transcript of a routine opening-hours question has no obvious reason to outlive the interaction by long.
A common mistake is to pick a number from a different record type and apply it everywhere. Employers must keep time and wages records for 7 years, and tax records have their own seven-year rule. Applying that to every support transcript, as one Australian privacy consultancy points out, stretches one statute over records it does not cover.
Some organisations do choose seven years by policy. Qudos Bank, for example, says it stores live chat transcripts securely for 7 years and will not use chat information for marketing. That is a published policy decision by a regulated lender, not a rule every business must copy.
What the Privacy Act requires under APP 11
Australian Privacy Principle 11 is the rule that matters most. According to the OAIC, an APP entity must take reasonable steps to protect personal information, and to destroy or de-identify it when it is no longer needed for any purpose for which it may be used or disclosed under the APPs. The exceptions are a Commonwealth record, or information that Australian law or a court or tribunal order requires you to retain.
Two practical points follow.
Transcripts are personal information in most cases. Names, phone numbers, account details, health details and the free text a customer types all count. If a transcript can be linked to a person, APP 11 applies.
Over-retention is a risk, not a safety net. The OAIC says holding too much personal information can increase the harm in a data breach and amplify reputational and financial risk. A archive of five years of transcripts is five years of material an attacker can steal.
The same consultancy warns that if you do not document why you collected data, you may be unable to show when the need has ended. The data then sits indefinitely without justification. The fix is simple: record the purpose when you design the chat channel.
For a deeper walkthrough of how this connects to chatbots, see our 30-day chatbot retention plan.
AI chat adds extra obligations
If an AI agent produces or handles the conversation, the OAIC’s guidance on commercially available AI products applies as well. It says personal information that is generated or inferred by AI must still be reasonably necessary for your functions or activities, and collected by lawful and fair means. Organisations should also give clear information about their use of AI.
That has three consequences for your retention design:
- Summaries and inferences count. If your platform stores a sentiment score, an intent label or a generated summary about a customer, that is personal information too. Give it a retention period.
- Tell customers. Your privacy notice and chat start screen should say that the conversation is stored, for how long and for what purpose.
- Keep personal data out of public AI tools. As best practice, the OAIC recommends avoiding entering personal information, particularly sensitive information, into publicly available generative AI tools because of the significant and complex privacy risks.
Our guide to OAIC chatbot rules and sovereign hosting covers the privacy impact assessment and contract steps in more detail.
Do sector and public-sector rules change the answer?
Yes, they can. The right period depends on who you are.
Government agencies
Public-sector bodies face records legislation. In Queensland, agencies must manage Click-to-chat conversations as public records under the Public Records Act 2023 and their recordkeeping policies. Each agency sets a retention and disposal schedule based on its obligations and a risk assessment. The same guidance expects a website disclaimer explaining how chat interactions are managed, including how transcripts are stored and how customers can obtain one.
At the federal level, the National Archives of Australia says prompt and response logs are generally low value and eligible for disposal. Agencies should set and document a period in their normal administrative practice policy, and avoid indefinite retention under default system settings.
Banks, insurers and other regulated entities
Financial services, health and legal businesses often have longer periods embedded in their licences, professional standards or prudential rules. The research behind this article did not find a single chat-specific figure for these sectors, so check your own licence conditions and ask your compliance lead which rules reach your transcripts. If your business falls under APRA’s information security standard, our CPS 234 guide for chatbots explains how chat data fits in.
Health providers
Clinical conversations can become part of a patient record, which is subject to state and territory health records rules. Separate the two: administrative chats about bookings are one class, clinical content is another. Our healthcare chatbot compliance controls go through how to draw that line.
Chat transcripts are not telecommunications metadata
People often confuse chat transcript retention with the national data retention scheme. They are different. The mandatory two-year storage requirement applies to telecommunications service providers as defined in the Telecommunications (Interception and Access) Act 1979. Your customer-service chat transcripts are internal business records. They are governed by the Privacy Act and your own policies, not by that scheme.
If you are not a carriage service provider, the two-year metadata rule does not create an obligation for you. Do not cite it as your reason for keeping chat logs.
Recording consent still matters
Retention starts with lawful collection. For voice and some audio-enabled chat, state and territory laws generally make it a criminal offence to record private conversations or disclose recordings without the consent of the parties, subject to exceptions. Law firm Sparke Helmore advises that organisations should typically obtain informed consent before recording.
Text chat is usually less fraught, since the customer knows they are typing into a system that keeps a log. Voice agents are different. If your AI answers phone calls, put a clear notice at the start and record the consent. We cover the steps in call recording compliance in Australia.
How to set a retention schedule you can defend
The Australian Cyber Security Centre advises businesses to set retention timeframes or criteria based on the use case, risk profile and type of personal data, and to delete the data immediately after it is no longer required. It recommends a stricter program with shortened timeframes where practical.
Here is a workable process.
- Inventory your chat channels. List web chat, in-app chat, SMS, email and voice transcripts, and where each is stored, including backups and analytics copies.
- Classify by purpose. Typical classes are general enquiry, sales lead, appointment booking, complaint, collections, and health or financial detail.
- Map each class to a legal driver. Is there a records law, licence condition, contract term or limitation period behind it? If not, the driver is business need.
- Set a period and a trigger. Use a clear trigger such as the end of the enquiry, the closure of a complaint or the end of a customer relationship, plus a fixed tail.
- Plan legal holds. Define who can suspend deletion when a dispute, investigation or regulator request is live, and how the hold is lifted.
- Automate deletion or de-identification. Manual clean-ups fail. Automatic deletion after the prescribed period is the control Sparke Helmore recommends, together with access protocols.
- Document the reasoning. Record the purpose, the period and who approved it. This is your evidence if the OAIC asks.
- Review on a schedule. Revisit when you add a channel, change a vendor or see a law change.
An illustrative schedule
The table below is an example structure, not a legal requirement. Your periods must come from your own legal advice and risk assessment.
| Transcript class | Typical trigger | Period approach | Notes |
|---|---|---|---|
| General enquiry | Conversation closed | Short, set by business need | De-identify for analytics |
| Sales lead | Lead closed or lost | Tied to the lead lifecycle | Respect opt-outs |
| Appointment booking | Appointment completed | Short tail after the visit | Clinical content moves to the patient record |
| Complaint | Complaint closed | Match your dispute process and limitation exposure | Apply legal hold if escalated |
| Financial transaction | Transaction date | Follow your licence and record-keeping rules | Confirm with compliance |
| Collections | Account closed | Follow your credit and collections obligations | Confirm with legal |
The National Archives also makes a point worth copying: capture records that must be kept in a system where they can be managed, protected, found and disposed of, rather than leaving them only inside an AI tool with no recordkeeping functions. If a transcript is a business record, move it to your CRM or records system and let the chat tool’s copy expire.
Securing the transcripts you keep
Retention is only half the job. The ACSC’s guidance says businesses should control access to customer personal data, encrypt it, back it up securely, and log and monitor access. Translate that into transcript terms:
- Access: limit who can read full transcripts. Most agents need only the current customer’s thread, not the archive.
- Encryption: encrypt in transit and at rest, including backups and exports.
- Backups: include backups in your deletion process. A transcript deleted from production but alive in a two-year backup is still retained.
- Logging: record who viewed, exported or deleted transcripts. Our audit log guide for chatbots lists what to capture and how to test it.
- Redaction: mask card numbers, health identifiers and government IDs before storage. See PII redaction for chatbots.
- Confidentiality: Sparke Helmore notes that AI models may not recognise confidential information as such and may treat it like less sensitive data. Do not rely on the model to flag what is sensitive.
For a full control set, our chatbot security playbook walks through a privacy impact assessment and nine steps for IT teams.
Where the data lives matters
A retention schedule is hard to enforce if transcripts replicate to overseas servers you cannot audit. Ask every chat vendor where transcripts, backups, logs and model inputs are stored, who can access them, and how deletion is confirmed. Our guide on preventing offshore data transfers in AI gives privacy teams a checklist.
Our perspective
We see the same pattern in enterprise projects. Teams ask “how long must we keep it?” when the better question is “why are we keeping it, and can we prove it?” A transcript archive with no purpose attached is a liability that grows every month.
That is why we build retention into the platform rather than leaving it to a spreadsheet. Our platform is hosted entirely in Australia as a private cloud, so your transcripts stay under Australian jurisdiction and under your control. Retention rules, access and reporting sit alongside the voice, SMS, email and live chat agents, so one policy can cover every channel instead of four.
We also hold SOC 2 certification, and we designed the platform for sectors where privacy is not negotiable: healthcare, finance, real estate and professional services. Where a customer needs even tighter control, we offer on-premises deployment.
Our advice is practical. Pick periods by purpose, automate disposal, keep legal holds explicit, and choose infrastructure that lets you answer a regulator’s questions without guessing.
Sowrabh
Put retention rules into your chat platform
If you run customer conversations across voice, SMS, email and live chat, a single Australian-hosted platform makes it far easier to apply one retention schedule, one access model and one audit trail. Our AI agents integrate with your existing CRM, so records that must be kept live in your system of record and the conversation copy can expire on schedule.
See how the Conversational AI platform handles Australian-hosted voice, SMS, email and chat agents, or look at the customer service solution if your main concern is support transcripts. Regulated teams that need full isolation can review on-premises deployment.
FAQ
How long should we keep customer chat transcripts in Australia?
There is no single mandated period for ordinary customer-service chats. Keep each class of transcript only as long as you need it for its documented purpose, or as long as a specific law, licence condition or court order requires. Many organisations land on a short period for general enquiries and a longer one for complaints or financial records, set with legal advice.
Do we need to delete chat transcripts when a customer asks?
The Privacy Act does not give an automatic right to deletion on request, but APP 11 requires you to destroy or de-identify personal information you no longer need. If a customer asks, check whether a legal or business purpose still justifies keeping the transcript. If it does not, delete or de-identify it, and keep a record of what you decided.
Does the two-year telecommunications data retention scheme apply to our chat logs?
No, unless you are a telecommunications service provider covered by the Telecommunications (Interception and Access) Act 1979. Customer-service chat transcripts are internal business records governed by the Privacy Act and your own policies.
Can we keep transcripts indefinitely to train our AI?
It is risky. Under APP 11 you must destroy or de-identify personal information when you no longer need it for a permitted purpose, and the OAIC says holding excess data increases breach harm. If you want transcripts for training or analytics, de-identify them first and document the purpose.
Should voice call recordings follow the same schedule as chat text?
Not necessarily. Voice recordings raise consent and surveillance-law issues on top of privacy law, and they are often larger and more sensitive. Set a separate period and make sure consent is captured at the start of the call.
Sources
- Retention and disposal of records FAQ, NSW Government
- Data retention in Australia: how long to keep customer data, Blackshard
- Record-keeping, Fair Work Ombudsman
- Live Chat Information Storage FAQs, Qudos Bank
- Chapter 11: APP 11 Security of personal information, OAIC
- Guidance on privacy and the use of commercially available AI products, OAIC
- Principles for the official use of Click-to-Chat as a channel, Queensland Government
- Information management for records created using AI technologies, National Archives of Australia
- Securing Customer Personal Data, Australian Cyber Security Centre
- Artificial Intelligence transcription, Sparke Helmore
- Telecommunications (Interception and Access) Act 1979 annual report 2022-23, Attorney-General’s Department
