Drug and alcohol test records are among the most sensitive data an Australian employer holds. They contain personal health information, are subject to strict privacy legislation, and may be required as evidence years after the test was conducted. Getting your data retention policy right — how long you keep records, how you store them, and how you destroy them — is a legal necessity, not an administrative preference.

This guide covers the federal and state legislative requirements that govern drug test record retention in Australia, along with practical recommendations for building a compliant retention policy.

Federal Privacy Act Requirements

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to all organisations with an annual turnover of more than $3 million, as well as health service providers and certain other entities regardless of turnover. For most employers conducting drug and alcohol testing, the Privacy Act applies.

Key requirements under the APPs include:

• APP 11 — Security of personal information: Organisations must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.
• APP 11.2 — Destruction or de-identification: If an organisation no longer needs personal information for any purpose for which it may be used or disclosed under the APPs, and the information is not required to be retained by or under an Australian law or a court/tribunal order, the organisation must take reasonable steps to destroy or de-identify the information.

The Privacy Act does not prescribe a specific retention period for drug test records. Instead, it requires organisations to retain records for as long as they are needed and destroy them when they are not. This creates a tension: retain too long and you risk holding unnecessary sensitive data; destroy too soon and you may lose records needed for legal proceedings or regulatory compliance.

WHS Record Requirements

Under the model Work Health and Safety Act 2011 and associated regulations (adopted with variations by all jurisdictions except Victoria and Western Australia), certain workplace health and safety records must be retained for specified periods:

• Health monitoring records: Must be kept for at least 30 years from the date of the last entry (WHS Regulation, clause 378). While drug and alcohol testing is not always classified as “health monitoring” under the Regulations, some jurisdictions and legal practitioners argue that it falls within the broader obligation.
• Incident notification records: Must be kept for at least 5 years.
• Risk assessment records: No specific period mandated, but best practice is a minimum of 7 years.

Where drug testing is conducted as part of a formal health monitoring program (for example, in response to specific hazardous substance exposure), the 30-year retention requirement is likely to apply.

State-by-State Health Records Legislation

New South Wales

The Health Records and Information Privacy Act 2002 (NSW) applies to health information held by both public and private sector organisations. It requires organisations to retain health information for a reasonable period, generally interpreted as at least 7 years from the date of the last entry (or until the individual turns 25, whichever is later, for records relating to minors). The Act does not specify a maximum retention period but requires destruction when records are no longer needed.

Victoria

The Health Records Act 2001 (Vic) establishes Health Privacy Principles that govern the handling of health information. Victorian health records must be retained for a minimum of 7 years from the date of the last entry. The Occupational Health and Safety Act 2004 (Vic) has its own record-keeping requirements that may apply depending on the nature of the testing program.

Queensland

Queensland does not have standalone health records legislation equivalent to NSW or Victoria. Health information is covered by the Information Privacy Act 2009 (Qld) for the public sector, and by the federal Privacy Act for private sector organisations. The Work Health and Safety Act 2011 (Qld) applies the model WHS provisions. A general retention period of 7 years is recommended for drug test records in Queensland.

Western Australia

Western Australia operates under the Occupational Safety and Health Act 1984 (WA) and its associated regulations, rather than the harmonised WHS Act. The Freedom of Information Act 1992 (WA) and general privacy principles apply. There is no specific health records legislation for the private sector. A minimum retention period of 7 years is recommended, with 30 years recommended where testing is part of a health monitoring program.

South Australia

South Australia does not have standalone health records legislation. The Work Health and Safety Act 2012 (SA) adopts the model WHS provisions. Private sector health information is governed by the federal Privacy Act. A retention period of 7 years is recommended for standard drug test records.

Tasmania

The Personal Information Protection Act 2004 (Tas) applies to Tasmanian government agencies but does not extend to the private sector. Private employers are governed by the federal Privacy Act. The Work Health and Safety Act 2012 (Tas) adopts the model WHS provisions. A 7-year retention period is recommended.

Northern Territory

The Information Act 2002 (NT) applies to Northern Territory government agencies. Private sector employers are governed by the federal Privacy Act. The Work Health and Safety (National Uniform Legislation) Act 2011 (NT) adopts the model WHS provisions. A 7-year minimum retention period is recommended.

Australian Capital Territory

The Health Records (Privacy and Access) Act 1997 (ACT) applies to health records held by both public and private sector health service providers. The Work Health and Safety Act 2011 (ACT) adopts the model WHS provisions. A 7-year retention period is recommended for standard drug test records, with longer retention for health monitoring records.

Recommended Retention Periods

Given the patchwork of federal and state requirements, the following retention periods are recommended as a practical, conservative approach:

• Standard drug test records (negative results): Minimum 7 years from the date of the test.
• Non-negative and confirmed positive results: Minimum 7 years, or longer if the result led to disciplinary action, workers’ compensation claim, or legal proceedings. In such cases, retain until the matter is fully resolved plus an additional 7 years.
• Health monitoring testing records: 30 years from the date of the last entry, in accordance with WHS Regulation requirements.
• Selection event records: Same period as the associated test records.
• Chain of custody documentation: Same period as the associated test records.
• Training records: Duration of employment plus 7 years.
• Policy versions: Indefinitely (retain all historical versions to demonstrate the policy that applied at any given time).

Secure Destruction

When the retention period expires, records must be destroyed securely — not simply deleted or discarded. Secure destruction requirements include:

• Paper records: Cross-cut shredding or professional document destruction services that provide a certificate of destruction.
• Digital records: Secure deletion using methods that prevent data recovery. For cloud-hosted systems, ensure the provider’s data destruction policies meet Australian standards. Obtain written confirmation of destruction.
• Backup copies: Ensure that backup copies are also destroyed. A record that has been deleted from the primary system but remains in backups has not been effectively destroyed.

Document every destruction event: what was destroyed, the method used, the date, and the person responsible. This destruction log itself should be retained indefinitely as evidence of your compliance with data minimisation obligations.

Building Your Retention Policy

A formal data retention policy for drug test records should include:

• The types of records covered
• The retention period for each type, with the legislative basis
• Storage requirements (security, access controls, location)
• Review and destruction procedures
• Roles and responsibilities
• Legal hold provisions (suspension of destruction when records may be relevant to current or anticipated proceedings)

Review the policy annually and update it when legislation changes. Ensure all personnel who handle testing records are aware of the policy and trained in its requirements.

Need a platform that automates record retention, enforces access controls, and provides secure Australian-hosted storage? Visit fairtest.com.au to start your free trial and take the complexity out of data retention compliance.