Privacy Act 2020, s 22, principle 9
An organisation that holds information about you must not keep it for longer than is necessary for the purposes for which it was collected. For example, an organisation that vets employees for jobs can’t keep information about those employees indefinitely, though it may be appropriate to keep the files for a short time to protect itself against legal action.
This principle encourages organisations to think about how long they need to keep information. They’ll also need to take into account any specific laws that require information to be kept for certain minimum periods of time, such as tax information and health information.