Former Employee Records: The Data Breach Risk Hiding in Your Filing Cabinets

The Problem: Former Employee Files Are a Goldmine for Criminals

Your HR filing cabinets contain everything needed for identity theft:

• Tax File Numbers
• Bank account details
• Residential addresses
• Birth dates
• Medicare numbers
• Emergency contact information
• Next of kin details

And most businesses keep these records for years—often decades—longer than legally required.

The Overlooked Vulnerability

While businesses focus on protecting current employee data, former employee records often sit forgotten in:

• Unlocked filing cabinets
• Unsecured storage rooms
• Offsite storage facilities with minimal oversight
• Cardboard boxes in corners
• Desk drawers of former managers

Real Impact: A Case Study

A Perth recruitment agency discovered their breach the hard way. A former employee's records from 2010—kept "just in case"—were stolen during an office break-in. The documents included:

• TFN and bank details
• Driver's licence copies
• Passport photocopies
• Reference letters with contact details

The former employee only discovered the theft when fraudulent accounts were opened in their name. The recruitment agency faced Privacy Act investigation, compensation claims, and significant legal costs.

The Solution: Employee Records Lifecycle Management

Know Your Retention Requirements

Employment Records (Fair Work):

• Pay records: 7 years
• Leave records: 7 years
• Hours worked: 7 years
• Superannuation contributions: 5 years

After These Periods: Secure destruction is not just permitted—it's advisable.

The 7-Year Rule

Most employee records can be destroyed 7 years after employment ends. This means:

• Employee who left in 2017: Records can be destroyed now
• Employee who left in 2018: Eligible for destruction in 2025
• Current employees: Records must be retained

What to Keep vs. Destroy

Destroy After 7 Years:

• Payslips and payment records
• Leave applications
• Timesheets
• Performance reviews
• Training records
• Day-to-day correspondence

Consider Keeping Longer:

• Records related to ongoing legal matters
• Workers' compensation claims (30 years in WA)
• Superannuation records affecting future entitlements
• Records of serious incidents

Secure Destruction Process

1. Annual audit of former employee files 2. Identify eligible records based on departure date 3. Obtain HR sign-off before destruction 4. Use NAID certified service for destruction 5. Maintain destruction log including: - Employee name - Employment dates - Record types destroyed - Destruction date and certificate number

WEST SHRED HR File Destruction

We understand the sensitivity of employee records:

• Police-checked staff handle all materials
• Chain of custody documentation provided
• Detailed certificates for HR compliance files
• Discreet collection from your premises