How long must a strata manager keep owner records?

It depends on two layers. State strata law sets a minimum: New South Wales and Victoria both require most records to be kept for seven years, while Queensland runs a tiered scheme (typically two or six years, depending on the record). If your managing-agent business is also covered by the Privacy Act, APP 11.2 pulls the other way and says destroy personal information once you no longer need it. The honest answer is to keep records for the statutory period, then dispose of ex-owner data rather than hoard it.

By Jon Oates, Founder of Privaproof · Last updated 23 July 2026

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.

Need to know

Two rules pull in opposite directions on the same file: state strata law sets a minimum period you must keep records, while the Privacy Act's APP 11.2 tells covered managers to destroy personal information once it is no longer needed.
The state strata-law retention floor binds you regardless of turnover and varies by jurisdiction (NSW is commonly stated at about seven years under SSMA s 180; Victoria, Queensland and other states set their own periods, so check your own state's Act).
APP 11.2 only applies if your managing-agent business is a covered APP entity (turnover over A$3 million or part of a larger covered group), and it does not force deletion of records the strata Act requires you to keep, since its destruction obligation switches on only after the statutory retention period ends.
The honest, safe practice is to keep records for the statutory minimum then dispose of ex-owner data via a written state-tailored retention and destruction schedule, with CCTV footage held on a much shorter, separate cycle governed by state surveillance-devices law.

Two rules, opposite directions

Most retention questions in strata come down to a tension people do not expect. One rule says keep, the other says destroy, and both can apply to the same file at once.

State strata law sets a floor. It requires the owners corporation, and in practice the manager who holds the records for it, to keep the roll, minutes, financial records and correspondence for a set minimum period.
The Privacy Act (APP 11.2) sets a ceiling, but only if your business is covered. It says that once personal information is no longer needed for any purpose for which it may be used or disclosed, and you are not required by law to retain it, you must destroy or de-identify it.

So the statutory floor keeps you honest against deleting too soon, and APP 11.2 keeps you honest against hoarding forever. The safe reading is not "pick one." It is: keep for the period the law requires, then stop keeping.

The state strata-law floor: how long you must keep records

This is the layer that binds you regardless of turnover, whether or not the Privacy Act reaches your business. It lives in your state's strata legislation, not the federal Act, so it varies by jurisdiction.

New South Wales. The Strata Schemes Management Act 2015 requires strata records, including the strata roll, to be kept for a minimum of seven years (SSMA s 180). The roll content itself (owners' names and addresses, and other prescribed details) sits at s 178.
Victoria. The Owners Corporations Act 2006 sets a similar period. Consumer Affairs Victoria states that an owners corporation must keep all records for at least seven years, except voting papers and proxies, which are kept for at least 12 months, and foundational documents (the plan of subdivision, AGM minutes, building and planning permits, and the like), which are kept for the life of the building. The retention rule is s 145 (with s 144 setting what must be kept).
Queensland. Queensland is different: it runs a tiered scheme rather than a flat seven years. Under the Body Corporate and Community Management regulation modules, some records may be disposed of six years after they are made, and minor records two years after, in each case only if they are no longer current, while records with continuing relevance are kept indefinitely (Standard Module s 231; the exact tiers are module-dependent, so check which module governs your scheme).
Other states and territories. Each has its own strata, community-titles or unit-titles legislation with its own retention rules. If you are not in NSW, Vic or Qld, check your own state's Act rather than assuming the NSW seven-year figure applies to you.

The practical point is the same everywhere: there is a legally required minimum hold. You cannot lawfully purge current-scheme records just because privacy feels tidier, and you cannot refuse a lawful inspection of records you are required to keep. See who can access the strata roll?

APP 11.2: if you are covered, do not keep it forever

Here is the part generic retention advice gets wrong for strata.

APP 11.2 only bites if your business is an APP entity, that is, your managing-agent business turns over more than A$3 million, or it is a related body corporate of a larger covered group. The owners corporation itself is almost always a small business and usually exempt, and many smaller independent managers genuinely fall outside the APPs too. If that is you, APP 11.2 does not directly bind you (though the state retention floor still does). See does the Privacy Act apply to strata managers?

If your business is covered, APP 11.2 requires you to take reasonable steps to destroy or de-identify personal information once both of these are true:

1. you no longer need it for any purpose for which you may use or disclose it under the APPs, and 2. you are not required by an Australian law or a court or tribunal order to keep it.

That second limb is the safety valve. While your state strata Act requires you to hold the record, APP 11.2 does not force you to delete it. The obligation to destroy only switches on once the statutory retention period has run out and there is no other lawful reason to keep the data. So APP 11.2 does not contradict the strata floor; it takes over at the end of it.

(A note on how this reconciliation is anchored: the "keep for the statutory period, then dispose" reading draws on the OAIC's general approach to APP 11.2 and, by analogy, the Pound Road Medical Centre determination, which was a medical matter, not a strata determination. Treat it as a reasoned position, not a strata-specific ruling. before publishing any fixed retention period as advice.)

The honest answer: keep, then dispose, do not hoard

Put the two layers together and the practical rule is straightforward:

While the scheme is current, keep the records you are required to keep, secured and accessible for lawful inspection.
For the statutory minimum after a matter closes or an owner sells, keep the relevant records (the exact period is set by your state's Act, so confirm it).
After the statutory period, if you are a covered manager, APP 11.2 turns from permission to obligation: personal information you no longer need, and are no longer required to keep, should be destroyed or de-identified. Hoarding a former owner's or ex-tenant's file "just in case", years after they left the scheme, is the failure mode APP 11.2 targets.

Even if you are not a covered APP entity, the same disposal discipline is simply good practice. A file you no longer hold cannot be caught in a breach, and strata offices have already been ransomware targets. Old ex-owner data is pure downside risk once the law no longer requires you to keep it. See a data-breach response plan for strata managers

Build it into a retention schedule, not a habit

The way to keep both rules satisfied is a written retention and destruction schedule, tailored to your state, that records for each type of data:

what you hold (roll, minutes, financials, correspondence, arrears and debt-recovery files, by-law-breach records, CCTV footage, access and swipe logs, contractor details),
the statutory minimum you must keep it for,
when the retention clock starts (often when an owner sells, a tenancy ends, or a matter closes),
and how it is securely destroyed or de-identified at the end.

CCTV footage sits on a much shorter cycle than the roll and is governed by state surveillance-devices law as well, so treat it separately. A retention schedule turns "how long do we keep this?" from a per-file guess into a repeatable rule, which is exactly what a covered manager needs to show it took reasonable steps. This is one of the documents in the strata kit; see what a strata manager's privacy policy actually needs

Common questions

Is the record-keeping period the same in every state?

No. Retention is set by each state's strata, community-titles or unit-titles legislation, not the federal Privacy Act, so it varies. New South Wales and Victoria both set seven years for most records (SSMA s 180; OCA s 145), while Queensland uses a tiered scheme of roughly two or six years depending on the record (Standard Module s 231). Outside NSW, Vic and Qld, confirm your own state's Act rather than assuming a seven-year figure.

If I am under $3 million and exempt, can I delete owner records whenever I like?

No. The Privacy Act's APP 11.2 may not bind an exempt manager, but your state strata law still requires you to keep records for a minimum period regardless of turnover. You must keep current-scheme and recent records for that statutory period, then dispose responsibly. The exemption removes an APP duty, not the strata-law duty.

Does APP 11.2 force me to delete records the strata Act says I must keep?

No, and this is the key reconciliation. APP 11.2 only requires destruction once you no longer need the data and no Australian law requires you to retain it. While your state strata Act compels you to hold the record, APP 11.2's destruction obligation does not apply. It takes effect only after the statutory retention period ends.

How long should I keep CCTV footage?

Much less time than the roll, and on a separate track. Common-property CCTV is governed by your state's surveillance-devices law as well as the Privacy Act if you are covered, and the OAIC's general position is to keep footage only as long as reasonably necessary, then delete it on a short, defined cycle. Set the specific period in your CCTV policy. See CCTV and surveillance privacy laws for strata

What about an owner who sold years ago, do I keep their file forever?

No. Keep it for the statutory minimum after they leave the scheme, then, if you are a covered manager, APP 11.2 says destroy or de-identify it once you no longer need it. Even if you are exempt, disposing of ex-owner data once the law no longer requires it is good practice and reduces your breach exposure.

Back to the strata privacy hub

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) and APP 11.2 apply to your business depends on your turnover and structure; state strata legislation sets separate, mandatory record-keeping periods that apply regardless, and those periods vary by jurisdiction. Privaproof's strata documents are self-authored and are not independently reviewed by a solicitor. Retention periods and section references change over time, so confirm the current requirement in your own state's Act and check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.