FlowmatixGuide · Records & retention
How long do you need to keep visitor records in Australia?
The honest answer is: it depends on why you're keeping them. There isn't one national number that covers every visitor sign-in. Here's how to reason about it — and how to stop the question being a manual chore.
General information to help you review your own obligations, not legal advice. Confirm your specific duties for your industry and state.
Why there's no single number
A visitor record can serve several different purposes at once, and each pulls the retention period in a different direction:
- Work health & safety. If a sign-in or induction record is evidence about who was on site and what they were told, it matters most after an incident — and incident-related records are often kept for years, not weeks.
- Privacy. Under the Australian Privacy Principles, you generally shouldn't hold personal information for longer than you reasonably need it. Keeping every visitor's details forever "just in case" runs the other way.
- Industry & contractual rules. Some sectors and some head-contractor agreements set their own minimums.
So "how long" is really a policy decision: long enough to meet your safety and contractual needs, and no longer than privacy expects. The trap is picking a number and then never actually enforcing it.
The real problem isn't the number — it's the enforcement
Most organisations can state a retention policy. Far fewer can show that it's actually followed. A paper visitor book has the opposite problem to a filing cabinet that never gets cleared: one is unfindable, the other never forgets. Both fail the same test — you're not in control of the data you hold.
What good looks like is boring and specific:
- You choose a retention period that reflects your obligations.
- Records older than that are removed automatically, on schedule — not when someone remembers.
- The clean-up never deletes a record for someone who is still on site, so an open sign-in is never lost by accident.
- Everything that happens is itself logged, so you can show the policy was applied.
How Flowmatix handles it
Retention in Flowmatix Visitor Management is a setting, not a promise. You configure how long visitor records are kept; older records are purged automatically to that schedule; and the purge deliberately skips anyone who is still signed in. Your data lives in your own database, handled under the Australian Privacy Principles — and the whole trail is auditable, so you can show what was kept, and what was cleared, and when.
In other words: you make the policy decision once, and the system keeps it — instead of you keeping a filing cabinet.
Set your retention once. Let it enforce itself.
See how sign-in, evidence and retention work together.