Managing HR Documents and Employee Records in Australia

The question people ask me about employee records is usually the wrong one. They ask how long they have to keep things. The better question is which set of rules a given record sits under, because a business with workers on site keeps records under at least 3 sets at once, and only one of them says 7 years.

Here is what each set asks for, with the period attached. The last part is worth reading twice: documents you collect from contractors are not employee records, and almost nothing on this page applies to them the way people assume.

What the Fair Work Rules Make You Keep.

Time and wages records have to be kept for 7 years. They have to be readily accessible to a Fair Work Inspector, legible, and in English. They cannot be changed unless the change corrects an error, and they cannot be false or misleading to the employer’s knowledge.¹

The categories, and what has to be in each one:¹

• General. Employer and employee name, the employer’s ABN if it has one, the commencement date, full-time or part-time, and permanent, temporary, or casual.
• Pay. The pay rate, gross and net amounts paid, any deductions, and details of any incentive-based payment, bonus, loading, penalty rate, or other monetary allowance.
• Hours of work. Overtime hours and when they started and finished, the hours worked by a casual or irregular part-time employee paid on time worked, and any written agreement to average hours.
• Leave. Leave taken and leave balances, plus any agreement to cash out leave with the rate of payment and when it was paid.
• Superannuation contributions. The amount, the pay period, the dates paid, the fund name, and the reason the employer paid into that fund.
• Individual flexibility agreements. The written agreement, and any notice or agreement terminating it.
• Guarantee of annual earnings. The guarantee, and the date it was cancelled where that applies.
• Ending employment. How the employment was terminated, and who terminated it.

Two more get missed. On a transfer of business the old employer hands the new employer the records of any transferring employee, and the new employer has to ask for them for anyone who becomes an employee within 3 months of the sale. And an employee who asks to see their own records must be given access, including after they have left.¹ The authority for all of it is sections 535 and 539 of the Fair Work Act 2009 and regulations 3.31 to 3.44 of the Fair Work Regulations 2009.¹

Pay Slips Run on a Separate Clock.

A pay slip has to be given to an employee within 1 working day of pay day, even if the employee is on leave. It can be electronic or hard copy, and an electronic pay slip must carry the same information as a paper one.²

What has to be on it: employer and employee names, the ABN if applicable, the pay period, the date of payment, gross and net pay, the ordinary hourly rate with the hours worked at it and the total paid at it, any loadings, allowances, bonuses, incentive payments, or penalty rates separable from the ordinary rate, any deductions with the fund or account they went to, and any superannuation contributions with the fund name.²

Two details catch people out. Leave balances are best practice rather than a requirement, although you must tell an employee their balance if they ask. And a pay slip must not mention paid family and domestic violence leave at all, balances included; the amount is recorded as ordinary hours or another payment for performing work, to reduce the risk to that employee’s safety.²

The WHS Records a Payroll System Will Not Hold.

This is where HR-framed advice stops and the exposure starts. The model WHS Regulations require records that have nothing to do with pay, sit with the safety team, and outlive the employment by decades.

• Training and competency records. Regulation 39 requires information, training, and instruction suitable for the work and its risks, and sets no retention period at all. The periods attach to specific hazards instead. Confined space training records are kept for 2 years. Asbestos training records are kept while the worker is doing the work and for 5 years after the day they cease working for you, and a licensed asbestos removalist keeps them for 5 years after the worker stops licensed removal work. Crystalline silica training records also run for 5 years after the worker ceases working for you.³
• Induction records. Neither the model Act nor the model Regulations set a retention period for a site induction. They require that the worker was trained before the work started, so the record has to survive long enough to prove it. Construction adds a currency rule: a worker who completed general construction induction training more than 2 years ago and has not carried out construction work in the 2 years since must be trained again.³
• Health monitoring records. The long ones. Health monitoring reports for hazardous chemicals are kept as a confidential record for at least 30 years after the record is made, and lead reports carry the same 30 years. Asbestos health monitoring reports run for at least 40 years. In every case the report must not be disclosed to another person without the worker’s written consent. Air monitoring results are kept for 30 years and must be readily accessible to anyone who may be exposed.³
• The register of injuries. SafeWork NSW requires a register recording the injured worker’s name, address, and age at the time of injury, their occupation and industry, and the time, date, nature, and cause of the injury, kept in writing or electronically.⁴ That page states no retention period, and the register sits under NSW workers’ compensation law rather than harmonised WHS law, so the detail differs by state. Check your own jurisdiction.
• Notifiable incidents. Section 38 of the model Work Health and Safety Act requires a person conducting a business or undertaking to keep a record of each notifiable incident, notifiable extended absence, or notifiable suicide for at least 5 years from the day notice of it is given to the regulator.⁵

Not One of Those Periods Is 7 Years.

The 7-year rule is a Fair Work rule and it applies to time and wages records. Nothing in work health and safety law adopts it.

Set them side by side and the problem shows itself. A worker leaves after 18 months. Their pay records have 7 years to run. Their confined space training record has 2. Their asbestos health monitoring report has 40, and may not be shown to anyone without their written consent. A policy that applies one number to a folder called “employee files” is wrong on every line except the payroll one.

The fix is to hold the period against the document type rather than against the person. That is what a document category is for: the category carries the requirement and the expiry behaviour, so one worker profile can hold documents running on completely different clocks.¹⁰ A worker compliance record treated as a single thing with a single expiry date is the failure mode.

Privacy, and Where the Employee Records Exemption Stops.

The Privacy Act 1988 and its 13 Australian Privacy Principles govern how personal information is collected, used, disclosed, secured, and corrected. A private sector employer’s handling of employee records is exempt where the act or practice directly relates to a current or former employment relationship, or to an employee record held about that individual.⁶

The exemption is narrower than the way it gets quoted. The Office of the Australian Information Commissioner is explicit that it does not cover future employment relationships, so it does not reach an unsuccessful job applicant; once someone is hired, the pre-employment checks you hold become exempt, but not before. It does not cover acts outside the employment relationship, its example being a list of employees sold for marketing. It does not cover volunteers. And it does not cover a contractor or subcontractor handling another business’s employee records, which catches recruitment, human resources, medical, training, and superannuation providers.⁶

Public sector records are different again: the Australian Privacy Principles apply in full to Australian Government and Norfolk Island administration employee records.⁷

Contractor Records Are Not Employee Records.

A contractor is not your employee. It follows that the documents you collect from them are not employee records, the employee records exemption does not touch them, and the Australian Privacy Principles apply to that pile in full.

In practice you hold a lot of it: photo identification, licences, high risk work tickets, qualifications, insurance certificates naming individuals, medical clearances, induction completions, and sometimes health information. All personal information, about people you do not employ.

The principle that bites hardest is Australian Privacy Principle 11.2. Once you no longer need personal information for any purpose for which it may be used or disclosed, and it is not contained in a Commonwealth record, and no law or court or tribunal order requires you to keep it, you must take such steps as are reasonable in the circumstances to destroy the information or ensure it is de-identified.⁸

Read that against a contractor prequalification archive quietly growing since 2019 and the gap is uncomfortable. There is no 7-year rule to shelter under. There is a duty to stop holding what you no longer need, running alongside the WHS periods above, which are the law that keeps some of it alive.

Two rules of thumb follow. Keep the document the duty needs, not the whole file the contractor sent. And know who else holds the same document, because a labour hire firm, a head contractor, and a client can each hold one worker’s ticket under 3 different obligations, a split our post on labour hire works through.

Three Records to Pull Out and Look At.

Pick 3 things. Whether a pay period 7 years old could be produced legibly, in English, today. Whether a health monitoring report is sitting in a shared folder rather than as a confidential record with consent controls on it. And whether your oldest contractor file holds documents you now have no purpose for.

The teams who get this right do not have better filing. They have the period written against the document type, the access written against the record, and a way to see which compliance obligation each item satisfies. A competency matrix plotting every worker against every required document, with expired and rejected items in red, answers that in one screen instead of an afternoon.⁹

For the system rather than the law, read what a compliance document management system does that a shared drive cannot. For documents belonging to a site rather than a person, site documents management covers those, including which version was in force on the day.