Data Retention Policy Template for Mortgage Brokers

What a Data Retention Policy Covers

The policy records why each record is held and when its retention period starts and ends. It also assigns responsibility for protecting records and approving their disposal.

For a brokerage, the register extends beyond the customer relationship management (CRM) system. Email attachments, downloaded identity documents and a meeting platform’s transcript can hold the same client’s information in separate places.

Australian Privacy Principle (APP) 11 requires covered businesses to protect personal information. Under APP 11.2, they must take reasonable steps to destroy or de-identify information they no longer need for a permitted purpose, subject to exceptions.

An Australian law or court order requiring retention is one exception. The Office of the Australian Information Commissioner’s APP 11 guidance explains the rule.

Credit obligations create a separate need to preserve evidence of the assessment and recommendation. A policy connects those obligations to an approved schedule. APP 11 itself doesn’t prescribe a single retention period for every brokerage record.

Retention Periods for Broker Records

Broker records have different retention rules, and each rule has its own starting event. A seven-year period measured from a credit assistance quote cannot be applied as seven years from settlement across the whole file.

The table distinguishes a fixed statutory period from records whose schedule needs a documented decision. Source years identify the legislation or guidance behind each entry.

Record	Period or retention rule	Source and scope
Preliminary assessment for credit assistance	Section 120 gives the consumer a right to request a written copy within seven years of the credit assistance quote under section 114. Preserve the assessment or material needed to supply it.	National Consumer Credit Protection Act 2009, section 120, 2026 compilation. The obligation doesn’t apply if credit assistance isn’t provided.
Best interests duty evidence in a mortgage file	ASIC specifies no single duration in RG 273.168. It identifies the loan term, interest-only period and refinancing as factors when deciding whether longer retention is needed.	ASIC Regulatory Guide 273, 2020 guidance. The compliance owner sets the schedule for this evidence.
Customer due diligence records, where the brokerage has reporting-entity obligations	Seven years from completion of an occasional transaction or the end of the business relationship.	AUSTRAC’s record-keeping guidance, applying section 111(2) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Use the rule applicable to the records concerned.
Identity copies held for other brokerage purposes	Apply the approved credit-file, contractual or other applicable rule. APP 11 doesn’t set a universal seven-year period for passport or licence copies.	APP 11.2. Record why each copy remains needed, including any lender verification obligation.
Complaints and supporting correspondence	RG 271.179 requires firms to record all complaints and track their progress. That paragraph doesn’t set a fixed disposal period.	ASIC Regulatory Guide 271, 2021 guidance. Set the schedule after assessing other obligations and dispute needs.
Call recordings, meeting transcripts and AI history	Apply the rule for the information and evidence they contain. The file format alone doesn’t set the period.	RG 273.167 includes audio recordings among possible evidence. APP 11.2 governs personal information that no longer needs to be held.

The anti-money laundering rule applies to reporting entities and relevant customer due diligence records. Collecting an identity document for a lender doesn’t, by itself, establish that this statutory clock applies to your brokerage’s copy.

For assessment requests under section 120, the response deadline is seven business days when requested within two years of the quote. Later requests within the seven-year window have a 21-business-day deadline. Retained files must remain retrievable quickly enough to meet that obligation.

Data Retention Policy Template

Use these clauses as the starting text for your brokerage’s data retention and disposal policy. Add the brokerage’s legal name, policy owner and approval details in the policy’s document-control fields.

Purpose and Coverage

Our brokerage keeps records to provide credit assistance and meet its applicable legal obligations. This policy applies to staff and contractors who handle brokerage records, including records held in external services.

The policy covers the main client file and copies held elsewhere. Personal accounts must not hold brokerage client records unless the compliance owner has approved their use and documented the controls.

Ownership and the Record Register

The compliance owner approves the retention schedule and decisions about exceptions. Each system owner updates the register of client records held in their system.

For each record category, the register identifies its purpose and location. It names the responsible person, approved access and any external provider holding a copy.

The Retention Schedule

Every schedule entry states the applicable rule and the reason for retention. It specifies the starting event, retention period and disposal method, with the person responsible for approval.

Staff must use the approved category for each record. If a record serves several purposes, the compliance owner resolves the applicable requirements before assigning its disposal date.

Preservation Holds

A preservation hold suspends routine disposal for records needed for a complaint, investigation, court process or other documented obligation. The compliance owner records the hold’s scope and tells affected system owners which records to preserve.

Only the authorised decision-maker releases a hold. Releasing a hold returns the records to a retention review before disposal.

Access and Retrieval

System owners restrict access to people who need the records for their work. They preserve readable records and the information needed to locate them throughout the approved retention period.

Changes to a provider or staff member must include a handover of required records. Closing an account must not remove the brokerage’s only accessible copy of retained evidence.

Disposal and the Disposal Register

The responsible person checks the schedule and any preservation hold before disposal. They use an approved destruction or de-identification method for the record and its storage medium.

The disposal register records the category and scope of records disposed of, the authority and the method used. It records when disposal occurred and the person who confirmed completion.

Review and Staff Responsibilities

The compliance owner reviews this policy when relevant obligations or systems change. Adding an AI service or recording function requires a review of the record register and retention schedule.

Staff report records held outside approved locations. System owners correct the location or controls and document how they dealt with any extra copies.

AI Tools, Recordings and Chat History

AI conversations and meeting recordings need their own entries in the record register because deleting the main client file may leave these copies intact. Assign each entry a purpose and retention rule before using the service with client information.

Add the following clauses to the policy for services that create or store those records.

AI Conversations and Uploaded Files

Staff must save the material relied on for a client recommendation in the approved client file. This includes relevant AI output and the source evidence used to check it.

The system owner documents the retention of prompts and uploaded files separately from the saved output. They also document shared conversations and any separate memory or knowledge store that can retain client information.

Meeting and Call Recordings

Before recording, staff must follow the brokerage’s approved recording and notification process. The record register must distinguish the original recording from its transcript and summary.

The compliance owner decides which versions form part of the retained evidence. An approved summary doesn’t automatically authorise deletion of the original recording when the original remains needed.

Provider Deletion and Backups

For each provider, the system owner documents what a deletion request removes and any backup retention. The process must address copies held by the provider, including its subprocessors where applicable.

APP 11’s guidance covers archived and backup copies as well as active records. For cloud-held information, the OAIC expects reasonable steps to verify that instructed destruction has occurred.

Keep a record of the deletion request and its outcome. A conversation disappearing from an account’s sidebar is insufficient evidence that every retained copy has been destroyed.

Before approving the next disposal batch, trace one record through its listed locations. Confirm that required evidence remains accessible and that each approved deletion has a recorded outcome.