Australia Privacy (Credit Reporting) Code 2025 22: Keep records evidencing compliance, including destruction, inter-provider disclosures with consent evidence, every disclosure with its permission basis, consents, refusal notices and ban, correction, complaint, pre-screening and audit correspondence, for at least 5 years

A body and a provider must maintain adequate records evidencing compliance with Part IIIA, the Regulations and the Code, including records of destruction of credit-related personal information where possible; for a provider receiving credit eligibility information from another provider, the date, the discloser, a description of the information and the evidence that consent requirements were met; for every disclosure of credit reporting or credit eligibility information, the date, description, recipient and evidence the disclosure was permitted; any consent given under Part IIIA, the Regulations or the Code; for a provider, any written refusal notice given within 90 days of obtaining credit reporting information; and correspondence and actions on ban requests and extensions, correction requests and notifications, complaints, pre-screening requests and provider monitoring and audits. Records must be retained for at least 5 years from creation, except that a body's records containing information it must destroy at the end of a retention period are kept only for that period.