How long can an accountant keep a client's TFN?

There is no fixed number of years. Rule 11(2) of the Privacy (Tax File Number) Rule 2015 requires you to take reasonable steps to securely destroy or permanently de-identify a client's tax file number information once it is no longer required by law to be retained and no longer necessary for a purpose under taxation law, personal assistance law or superannuation law. Where a record-keeping law applies, that law sets the floor for how long you must keep it; the TFN Rule sets the ceiling on keeping it any longer.

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.

Need to know

The Privacy (Tax File Number) Rule 2015 sets no fixed retention period; it requires you to securely destroy or de-identify a client's TFN once you are no longer required by law to keep it and no longer need it for a permitted purpose.
A record-keeping law sets the floor for how long you must hold the record while the TFN Rule sets the ceiling, so retention runs until the last legal retention period ends and every permitted purpose falls away.
The seven-year AML record-keeping floor is narrow: it applies only to AML/KYC data collected where you provide a designated service and are an AUSTRAC reporting entity (reaching that data via Privacy Act s 6E), not to routine tax files, ledgers or payroll.
The TFN Rule applies regardless of turnover and protects individuals' TFNs only, and secure destruction extends to copies in email, portals and backups, so a retention schedule is the practical way to prove you meet both floor and ceiling.

The rule: destroy when you no longer need it, not "keep it forever"

The Privacy (Tax File Number) Rule 2015 is a legally binding instrument made under s 17 of the Privacy Act 1988 (Cth), and it binds every "TFN recipient", and a practice or registered tax agent holding individual clients' TFN information is one. It applies regardless of your turnover, so the A$3 million small-business exemption does not change how long you may hold individual TFN information.

One of the Rule's obligations is retention and destruction. Rule 11(2) requires a TFN recipient to take reasonable steps to securely destroy or permanently de-identify TFN information where it is no longer (a) required by law to be retained, or (b) necessary for a purpose under taxation law, personal assistance law or superannuation law. The stem is negated, so both limbs have to have fallen away before the duty bites. There is no set period in the Rule itself. The trigger is need plus any legal retention requirement, not the calendar.

So the answer to "how long can I keep a client's TFN" is really two questions stacked together: how long does another law require you to keep the record, and when does the last permitted purpose fall away.

"Required by law to retain it": the floor

Several laws can require you to keep records that happen to contain a TFN, and those requirements set the minimum you must hold. Two that commonly apply to an accounting practice:

Tax record-keeping. Section 262A(1) of the Income Tax Assessment Act 1936 requires a person carrying on a business to keep records that record and explain all transactions relevant for any purpose of that Act, and s 262A(4)(a) sets the period at 5 years after the records were prepared or obtained, or the completion of the transactions or acts to which they relate, whichever is later. That retention limb is expressed to bind a person who has possession of the records, so it reaches a practice holding a client's records and not only the client. Where an individual client is substantiating work expenses rather than carrying on a business, the period is 5 years under s 900-25 of the Income Tax Assessment Act 1997, running from the due day for lodging the return, or from the day the return is lodged if that is later.
AML record-keeping. If your firm provides an AML designated service and is an AUSTRAC reporting entity, the record-keeping obligations in Part 10 of the AML/CTF Act 2006 apply, and for the professional-services designated services those obligations commenced on 1 July 2026. The period is 7 years in each case, but each provision runs from a different point: s 107(3) runs 7 years from the day the transaction record is made, s 108(2) runs 7 years after a document is given to you by or on behalf of the customer, and s 111(2), the customer due diligence limb that covers your KYC records, runs until the end of the 7 year period that begins when the business relationship ends. That floor reaches a tax file number only where the TFN sits in a record one of those sections requires you to keep.

While a law like these requires you to keep a record, you are "required by law to retain it", so the TFN Rule's destruction obligation does not bite yet. The floor wins for as long as it runs. The Privacy Act works the same way for personal information generally: APP 11.2(d) switches the destruction duty off while the entity is required by or under an Australian law, or a court or tribunal order, to retain the information, though APP 11.2 reaches only a practice that is an APP entity.

The AML seven-year floor is narrow, so do not over-apply it

It is easy to assume the seven-year AML figure governs everything. It does not. AML/CTF Tranche 2 makes a firm a reporting entity only where it provides a designated service, and the nine professional-services ones are listed in s 6(5B) of the AML/CTF Act (for example forming or restructuring a company or trust, holding client money as part of assisting a transaction, or acting as a nominee), with carve-outs in s 6(5C). Even then Privacy Act s 6E applies the Privacy Act to the AML/KYC identity data you collect for that service, not to your general tax files, ledgers or payroll, although the OAIC's position is that where the same information is collected for an AML purpose as well as a non-AML purpose the Privacy Act applies to that information.

Routine tax returns, financial statements, tax advice, BAS and GST work, bookkeeping, audit and payroll are not designated services. So the AML seven-year floor is the retention driver for your AML/KYC records, not a blanket rule for every TFN in your practice. For a practice that does no designated service at all, the AML floor does not apply, and retention is governed by the TFN Rule read together with tax and other record-keeping law. Read: which accounting services are designated? and does becoming a reporting entity trigger the Privacy Act?.

When the floor ends: the ceiling takes over

Once every retention law has run and you no longer need the TFN for a permitted purpose, the Rule's destruction obligation applies. At that point you should securely destroy or de-identify the TFN information rather than let it sit in old files, mailboxes and backups. "We might need it one day" is not a permitted purpose once the legal retention period has passed.

Practical points that follow from this:

Destroy securely. Reasonable steps means proper deletion or shredding, including copies in email, portals and backups, not just moving a file to an archive folder. Read: how must accountants store clients' tax file numbers?.
De-identify as an alternative. If you need the underlying record for a legitimate purpose but not the TFN, removing or permanently masking the TFN can satisfy the obligation for that data.
Keep a retention schedule. A short schedule that maps each record type to its legal retention floor and its destruction trigger is the practical way to prove you are meeting both the floor and the ceiling.

Scope, stated honestly

The TFN Rule protects the TFN information of individuals only, not the TFNs of companies, partnerships, trusts or super funds, and not your general (non-TFN) client database (r 5(2)). Handling TFNs does not make a small practice a full "APP entity" subject to all 13 Australian Privacy Principles; it creates targeted obligations, including this retention and destruction duty, for the individual TFN data you hold. Under s 13(4)(a) of the Privacy Act a breach of the Rule by a file number recipient is an "interference with the privacy of an individual", so keeping TFNs indefinitely with no basis is a real exposure to an OAIC complaint, not a technicality. Read: the TFN Rule 2015, what accountants must do.

Penalties here are ceilings, not certainties, and this page does not quantify them. The point of a retention schedule is not fear of a penalty, it is that holding sensitive TFN data you no longer need is avoidable risk.

Common questions

Is there a set number of years to keep a client's TFN?

No. The TFN Rule does not name a period. You keep TFN information for as long as a law requires you to retain the record and for as long as it is still necessary for a purpose under taxation law, personal assistance law or superannuation law, then you securely destroy or de-identify it. Any specific number comes from that other law: 5 years under s 262A(4)(a) of the Income Tax Assessment Act 1936, running from when the records were prepared or obtained or the transactions were completed, whichever is later, and 7 years under the AML/CTF Act where you are a reporting entity, running from a different point in each of ss 107, 108 and 111.

Does the seven-year AML period apply to every client TFN?

No. The seven-year AML record-keeping floor applies to the AML/KYC data you collect where you provide a designated service and are an AUSTRAC reporting entity, and under s 111(2) of the AML/CTF Act it runs until the end of the 7 year period that begins when the business relationship ends, not from the day you collected the data. Via Privacy Act s 6E it reaches that AML data only, not your general tax files. If your practice provides no designated service, the AML floor does not apply at all.

Can I just archive old TFNs instead of destroying them?

Once every legal retention period has ended and you no longer need the TFN for a permitted purpose, the Rule expects secure destruction or de-identification, not indefinite archiving. Archiving a TFN "just in case" is not a permitted purpose once the retention floor has passed.

Do I have to delete the TFN from email and backups too?

Reasonable steps to destroy TFN information extends to the copies you hold, which can include email, client portals and backups, not only the primary file. A retention and destruction procedure that accounts for those locations is the practical way to meet the obligation. Read: your data-breach obligations under the NDB scheme.

Keep reading

General information and compliance tools, not legal advice. Privaproof is not a law practice and does not provide legal advice. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC, or your record-keeping obligations under tax law, which are administered by the ATO. For advice on your specific circumstances, consult a qualified Australian legal practitioner. The Privacy Act 1988 (Cth), the TFN Rule 2015 and related record-keeping laws change over time, so check you are working from a current version.