Privacy Act 2020, s 22, principle 9
An organisation that holds information about you must not keep it for longer than is necessary for the purposes for which it was collected. For example, organisations that vets employees for jobs can’t keep information about those employees indefinitely, even though it may be appropriate for them to keep that information for a short time to protect themselves against legal action.
This principle encourages organisations to think about how long they need to keep information. They also need to take into account any specific laws that require information to be kept for certain minimum periods of time, such as tax information and health information.