---
title: "Decide whether personal information no longer needed should be destroyed or de-identified"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-personal-information-no-longer-needed-should-be-destroyed"
type: "task"
site: "AI Law Framework"
id: "A24-SF20261022-22"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Decide whether personal information no longer needed should be destroyed or de-identified

> From the holdings register, list each category, the purpose it was collected for, and any law or order on the file that says it must be kept.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-personal-information-no-longer-needed-should-be-destroyed  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the holdings register, list each category, the purpose it was collected for, and any law or order on the file that says it must be kept. Mark whether the client still uses it for that purpose or for a secondary purpose already checked. Leave the destroy or de-identify decision blank. |
| What the lawyer must review | Chapter 11 says reasonable steps must be taken to destroy personal information, or to ensure it is de-identified, once it is no longer needed for any purpose for which it may be used or disclosed under the APPs. It is still needed if it is necessary for the primary purpose or for a secondary purpose permitted under APP 6, and for an organisation also where it is needed for direct marketing under APP 7 or as a government related identifier under APP 9. The obligation does not apply to a Commonwealth record, or where an Australian law or a court or tribunal order requires the information to be retained. An organisation that holds the information, including where it does not have physical possession but has the right or power to deal with it, must take reasonable steps as to all copies, including archives and backups. Reasonable steps include technical and organisational measures. The Archives Act rule for destroying a Commonwealth record was not opened beyond the chapter's statement that destruction or alteration is generally only under section 24 of that Act. This is not the decision that a suspected breach is notifiable. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Lawyer review required**

The responsible lawyer reviews the work against the instructions, sources and intended use.

- What the AI does: From the holdings register, list each category, the purpose it was collected for, and any law or order on the file that says it must be kept. Mark whether the client still uses it for that purpose or for a secondary purpose already checked. Leave the destroy or de-identify decision blank.
- What the lawyer does: Chapter 11 says reasonable steps must be taken to destroy personal information, or to ensure it is de-identified, once it is no longer needed for any purpose for which it may be used or disclosed under the APPs. It is still needed if it is necessary for the primary purpose or for a secondary purpose permitted under APP 6, and for an organisation also where it is needed for direct marketing under APP 7 or as a government related identifier under APP 9. The obligation does not apply to a Commonwealth record, or where an Australian law or a court or tribunal order requires the information to be retained. An organisation that holds the information, including where it does not have physical possession but has the right or power to deal with it, must take reasonable steps as to all copies, including archives and backups. Reasonable steps include technical and organisational measures. The Archives Act rule for destroying a Commonwealth record was not opened beyond the chapter's statement that destruction or alteration is generally only under section 24 of that Act. This is not the decision that a suspected breach is notifiable.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Do not mark information for destruction while it is still needed for a permitted purpose. The secondary-use task is separate.
2. A Commonwealth record, or a law or order requiring retention, is not destroyed under this chapter.
3. Include archives and backups, and information a contractor holds where the client can still deal with it.
4. Do not treat this note as a data-breach decision.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Chapter 11, APP 11 Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-personal-information-no-longer-needed-should-be-destroyed/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*