How long must a strata manager keep owner records?

It depends on two layers. State strata law sets a minimum: in New South Wales an owners corporation must retain its records for seven years (SSMA s 180), and in Victoria for at least seven years, except voting papers, ballots and proxies at 12 months (OCA s 145). Queensland instead permits disposal in tiers, six years or two years depending on the record, and never while a document still has current relevance to the scheme (Standard Module s 231). If your managing-agent business is also covered by the Privacy Act, APP 11.2 pulls the other way and says destroy personal information once you no longer need it and no Australian law requires you to keep it. The honest answer is to keep records for the statutory period, then dispose of ex-owner data rather than hoard it.

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.

Need to know

Two rules pull in opposite directions on the same file: state strata law sets a minimum period you must keep records, while the Privacy Act's APP 11.2 tells covered managers to destroy personal information once it is no longer needed.
The state strata-law retention floor binds you regardless of turnover and varies by jurisdiction (NSW is commonly stated at about seven years under SSMA s 180; Victoria, Queensland and other states set their own periods, so check your own state's Act).
APP 11.2 only applies if your managing-agent business is a covered APP entity (turnover over A$3 million or part of a larger covered group), and it does not force deletion of records the strata Act requires you to keep, since its destruction obligation switches on only after the statutory retention period ends.
The honest, safe practice is to keep records for the statutory minimum then dispose of ex-owner data via a written state-tailored retention and destruction schedule, with CCTV footage held on a much shorter, separate cycle governed by state surveillance-devices law.

Two rules, opposite directions

Most retention questions in strata come down to a tension people do not expect. One rule says keep, the other says destroy, and both can apply to the same file at once.

State strata law sets a floor. It requires the owners corporation, and in practice the manager who holds the records for it, to keep the roll, minutes, financial records and correspondence for a set minimum period.
The Privacy Act (APP 11.2) sets a ceiling, but only if your business is covered. It says that once personal information is no longer needed for any purpose for which it may be used or disclosed, and you are not required by law to retain it, you must destroy or de-identify it.

So the statutory floor keeps you honest against deleting too soon, and APP 11.2 keeps you honest against hoarding forever. The safe reading is not "pick one." It is: keep for the period the law requires, then stop keeping.

The state strata-law floor: how long you must keep records

This layer sits in your state's strata legislation, not the federal Act, so it varies by jurisdiction. The duty is imposed on the owners corporation rather than on you as its agent (NSW SSMA s 180; Victoria OCA s 145), and it applies whatever the scheme's turnover, whether or not the Privacy Act reaches your business. Where the owners corporation has delegated its record-keeping functions to you (in NSW, under SSMA s 52), you are the one performing that duty in practice, and your management agreement will usually say so.

New South Wales. The Strata Schemes Management Act 2015 requires strata records, including the strata roll, to be kept for a minimum of seven years (SSMA s 180). The roll content itself (owners' names and addresses, and other prescribed details) sits at s 178.
Victoria. The Owners Corporations Act 2006 sets a similar period. Consumer Affairs Victoria states that an owners corporation must keep all records for at least seven years, except voting papers and proxies, which are kept for at least 12 months, and foundational documents (the plan of subdivision, AGM minutes, building and planning permits, and the like), which are kept for the life of the building. The retention rule is s 145 (with s 144 setting what must be kept).
Queensland. Queensland is different: it runs a tiered scheme rather than a flat seven years. Under the Body Corporate and Community Management regulation modules, listed documents (statements of account, notices of meetings, written agreements and the like) may be disposed of six years after their creation or receipt, and a shorter list (associated meeting material, correspondence of no significance or continuing interest, reconciliation statements) two years after. Nothing may be disposed of while it has current relevance to the scheme, and minutes, the body corporate roll and the registers are on neither disposal list (Body Corporate and Community Management (Standard Module) Regulation 2020 s 231). The section is numbered differently in each module (Accommodation s 220, Commercial s 177, Small Schemes s 146), so check which module governs your scheme.
Other states and territories. Each has its own strata, community-titles or unit-titles legislation with its own retention rules. If you are not in NSW, Vic or Qld, check your own state's Act rather than assuming the NSW seven-year figure applies to you.

The practical point is the same everywhere: there is a legally required minimum hold. There is a legally required minimum hold, and current-scheme records cannot be purged just because privacy feels tidier. In New South Wales an owner, mortgagee or covenant chargee (or a person they authorise) may request an inspection of the strata roll and the owners corporation's other records on written notice with the prescribed fee (SSMA s 182), and the regulation extends that to records kept by the strata managing agent (Strata Schemes Management Regulation 2016 cl 42). Victoria gives lot owners, mortgagees, purchasers and their representatives an equivalent right (OCA s 146). See who can access the strata roll?

APP 11.2: if you are covered, do not keep it forever

Here is the part generic retention advice gets wrong for strata.

APP 11.2 only bites if your business is an APP entity. The usual route in for a managing agent is turnover: a business that has had an annual turnover of more than A$3 million in a financial year is not a small business operator (Privacy Act s 6D(1), s 6D(4)(a)), and neither is a related body corporate of a covered entity (s 6D(9)). Section 6D(4) has four further limbs, and the one worth a look in strata is disclosing owner details for a benefit such as an insurance commission (s 6D(4)(c)), which is fact-specific and often carved out by consent under s 6D(7). An owners corporation whose annual turnover is A$3 million or less is a small business operator in its own right (s 6D(1)) and generally sits outside the APPs, and an independent managing agent under that threshold that is not part of a covered group and does not fall into another s 6D(4) limb may be too. If that is you, APP 11.2 does not directly bind you (though the strata retention duty on the scheme's records still stands). See does the Privacy Act apply to strata managers?

If your business is covered, APP 11.2 requires you to take reasonable steps to destroy or de-identify personal information once both of these are true:

1. you no longer need it for any purpose for which you may use or disclose it under the APPs, and
2. you are not required by or under an Australian law, or by a court or tribunal order, to keep it.

(APP 11.2 carries two further conditions that do not bite for a private managing agent: that you hold the information, and that it is not contained in a Commonwealth record.)

That second limb is the safety valve. While your state strata Act requires you to hold the record, APP 11.2 does not force you to delete it. The obligation to destroy only switches on once the statutory retention period has run out and there is no other lawful reason to keep the data. So APP 11.2 does not contradict the strata floor; it takes over at the end of it.

The honest answer: keep, then dispose, do not hoard

Put the two layers together and the practical rule is straightforward:

While the scheme is current, keep the records you are required to keep, secured and accessible for lawful inspection.
For the statutory minimum, keep the relevant records, and check what starts the clock in your state before you set a date. Queensland runs from the document's creation or receipt (Standard Module s 231(3), (4)); the NSW and Victorian sections state a period without naming a trigger, so record which trigger you have chosen and why.
After the statutory period, if you are a covered manager, APP 11.2 turns from permission to obligation: personal information you no longer need, and are no longer required to keep, should be destroyed or de-identified. Hoarding a former owner's or ex-tenant's file "just in case", years after they left the scheme, is the failure mode APP 11.2 targets.

Even if you are not a covered APP entity, the same disposal discipline is simply good practice. A file you no longer hold cannot be caught in a breach, and Australian strata managers have been hit: iTnews reported in October 2022 that Gold Coast firm SSKB had data taken and a ransom demanded on the dark web, and Cyber Daily reported in April 2026 that the Kairos group had listed Sydney firm Strata Republic. Old ex-owner data is pure downside risk once the law no longer requires you to keep it. See a data-breach response plan for strata managers

Build it into a retention schedule, not a habit

The way to keep both rules satisfied is a written retention and destruction schedule, tailored to your state, that records for each type of data:

what you hold (roll, minutes, financials, correspondence, arrears and debt-recovery files, by-law-breach records, CCTV footage, access and swipe logs, contractor details),
the statutory minimum you must keep it for,
when the retention clock starts, which your state's Act may not tell you (Queensland runs from creation or receipt; the NSW and Victorian sections are silent), so record the trigger you have chosen,
and how it is securely destroyed or de-identified at the end.

CCTV footage sits on a much shorter cycle than the roll, and in most States surveillance-devices law applies to it as well (Queensland's Act reaches listening devices only), so treat it separately. A retention schedule turns "how long do we keep this?" from a per-file guess into a repeatable rule, which is exactly what a covered manager needs to show it took reasonable steps. This is one of the documents in the strata kit; see what a strata manager's privacy policy actually needs

Common questions

Is the record-keeping period the same in every state?

No. Retention is set by each state's strata, community-titles or unit-titles legislation, not the federal Privacy Act, so it varies. New South Wales requires seven years (SSMA s 180), Victoria at least seven years for most documents with voting papers, ballots and proxies at 12 months (OCA s 145), and Queensland instead permits disposal six years after creation or receipt, or two years for minor records, and never while a document still has current relevance to the scheme (Standard Module s 231). Outside NSW, Vic and Qld, confirm your own state's Act rather than assuming a seven-year figure.

If I am under $3 million and exempt, can I delete owner records whenever I like?

No. APP 11.2 may not bind an exempt manager, but state strata law separately requires the owners corporation to keep records for a minimum period whatever its turnover (NSW SSMA s 180 sets seven years; Victoria OCA s 145 sets at least seven years for most documents). Where that record-keeping function is delegated to you, those are the records in your hands, so they cannot be purged on a privacy rationale. The exemption removes an APP duty, not the strata-law duty.

Does APP 11.2 force me to delete records the strata Act says I must keep?

No, and this is the key reconciliation. APP 11.2 only requires destruction once you no longer need the data and no Australian law requires you to retain it. While your state strata Act compels you to hold the record, APP 11.2's destruction obligation does not apply. It takes effect only after the statutory retention period ends.

How long should I keep CCTV footage?

Much less time than the roll, and on a separate track. Common-property CCTV is governed by your state's surveillance-devices legislation as well as the Privacy Act if you are covered, and the position is not uniform. Queensland's Invasion of Privacy Act 1971 regulates listening devices only and creates no general optical-surveillance offence (checked at source, August 2026), while the NSW and Victorian Acts do reach optical surveillance., and if you are covered, APP 11.2 requires you to take reasonable steps to destroy or de-identify footage once you no longer need it and no Australian law requires you to keep it. Set the specific period in your CCTV policy. See CCTV and surveillance privacy laws for strata

What about an owner who sold years ago, do I keep their file forever?

No. Keep it for the statutory minimum after they leave the scheme, then, if you are a covered manager, APP 11.2 says destroy or de-identify it once you no longer need it. Even if you are exempt, disposing of ex-owner data once the law no longer requires it is good practice and reduces your breach exposure.

Back to the strata privacy hub

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) and APP 11.2 apply to your business depends on your turnover and structure; state strata legislation sets separate, mandatory record-keeping periods that apply regardless, and those periods vary by jurisdiction. Retention periods and section references change over time, so confirm the current requirement in your own state's Act and check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.