Storing Employee Records for 7 Years: Where Fair Work Meets Cyber Security

Under the Fair Work Act 2009 (sections 535 and 536), employers must keep employee and pay records for seven years. The records must be in a legible form, in English, and readily accessible to a Fair Work Inspector on request. This applies to current and former employees — the seven-year clock keeps running after someone leaves.

The records that must be kept include: employee and employer details, pay rate and gross/net amounts, hours worked (for casuals and part-timers on penalty/loading rates), leave balances and leave taken, superannuation contributions and the fund, and how employment ended. Pay slips must also be issued within one working day of payment.

The Fair Work rule tells you how long and what — it doesn't tell you the part that trips businesses up: where and how those records are stored. Seven years of payroll and HR data — tax file numbers, bank details, superannuation, sometimes health and disciplinary information — is some of the most sensitive personal information an employer holds. Yet in a lot of small businesses it sits in an unencrypted shared drive, on a former bookkeeper's laptop, or in an email inbox, with no access controls and no tested backup.

Doing the storage half properly means: records held in encrypted, access-controlled storage (so only the right people can open them); role-based permissions rather than a folder everyone can see; and tested, offsite backups so a ransomware hit, a hardware failure or a departing staffer doesn't wipe seven years of evidence.

This matters beyond neatness. In an underpayment dispute, if you can't produce the records, the burden of proof effectively flips onto you — the Fair Work Act lets a court accept the employee's version of hours and pay where the employer failed to keep or produce compliant records. Lost or inaccessible records turn a defensible position into an indefensible one.

And the same files are a data-breach liability: a leak of payroll data (TFNs, bank accounts) can trigger obligations under the Notifiable Data Breaches scheme and real reputational damage. So the storage decision is simultaneously a Fair Work compliance decision and a cyber-security decision.

A practical baseline: move HR and payroll records into a properly permissioned system (for most Australian businesses that's Microsoft 365 / SharePoint or an equivalent), lock down who can access each folder, turn on encryption and audit logging, and set up backups you've actually tested a restore from. Keep the retention clock in mind — you need to be able to produce any record from the last seven years, quickly and legibly.

The Fair Work half is straightforward to get right (that's what this site is for). The IT half — encrypted, access-controlled, backed-up storage that a regulator or a court would accept — is where a lot of employers need a hand. If that's you, our IT partner Frontrow Tech sets up secure Microsoft 365 storage and tested backups for Australian businesses. General information only — not legal advice; confirm anything specific with the Fair Work Ombudsman or a qualified professional.