A Common Pattern Across Victorian Council Records Functions
Most Victorian councils hold records in third-party storage beyond their authorised retention period. Not intentionally, but because disposal is genuinely difficult to prioritise alongside everything else the role demands. Retention schedules need to be reviewed against current PROV authorities. Disposal triggers need to be confirmed before any decision can be made. And when a records manager is also managing FOI requests, system migrations, and competing operational demands, a box that could be destroyed tends to stay exactly where it is.
This isn’t a failure, but rather a predictable consequence of managing a complex, regularly-updated framework across an entire organisation’s record holdings, often in a spreadsheet and without a defined review cycle. But the costs of over-retention are more varied than the storage invoice alone, and they accumulate quickly.
How Is Over-Retention Defined?
Over-retention is the practice of holding records beyond their authorised retention period. Each PROV Retention and Disposal Authority (RDA) specifies how long a record must be kept and under what conditions it can be lawfully disposed of. Once those conditions are met, the record has reached its minimum retention period. Holding the record for longer seems like the cautious option. But it could actually fall outside the terms of the Privacy and Data Protection Act 2014.
PROV’s disposal authorities define a minimum retention period, but don’t define a maximum one. Once the minimum is met, disposal is authorised but not necessarily obligated. However, the absence of a legislative maximum retention period doesn’t mean organisations can hold records indefinitely without consequence.
For records containing personal information, the Privacy and Data Protection Act 2014 creates a positive obligation to destroy or de-identify that information once it is no longer needed for the purpose for which it was collected. For health records, the Health Records Act 2001 carries the same requirement. These aren’t best-practice guidelines. They’re enforceable obligations that sit above the RDA and cap how long certain records can legitimately be held.
For all other record types, continued retention past the RDA minimum is a matter of organisational policy, but only allowed where there is a valid and documented basis for doing so. Retaining records without a valid reason creates compliance exposure, and it’s the kind that tends to go unexamined.
Why Disposal Seems Harder Than Over-Retention
Retention is a holding pattern. It requires no immediate action, no sign-off process, and no coordination with a third party. Disposal requires all of those things. And when the process for actioning disposal isn’t clearly established, eligible records tend to sit in storage because no one has had the time or the structure to move them on.
Four patterns tend to drive over-retention in council records functions:
- No defined review cycle. Where disposal is managed ad hoc, actioned when someone gets to it rather than on a scheduled basis, batches of eligible records can accumulate for years. The intent to address them is often there. The dedicated time and process to do it consistently isn’t.
- Records in storage are out of sight, and largely out of process. Legacy archives that pre-date digitisation work exist outside the normal flow of records management. They may not be indexed, catalogued, or loaded into any records system and therefore don’t appear in searches or surface on a retention schedule. Disposal only tends to happen when a box gets physically retrieved, usually to fulfil an FOI request, which means it’s reactive, piecemeal, and never makes a dent in the broader backlog.
- Over-retention feels like the lower-risk choice. When disposal is irreversible and the consequences of getting it wrong are serious, holding on can seem like the prudent option. In some cases, it may genuinely be the right call. But this logic doesn’t always account for the cost and compliance exposure that builds on the other side. Both under- and over-retention carry risk. The goal is staying inside the authorised window with a documented basis, not simply defaulting to retention when disposal feels uncertain.
- Proactive disposal gets treated as a slow-period task. In a role where reactive demands fill most of the available hours, a systematic review of storage holdings tends to get deferred to quieter periods that rarely arrive. We’ve heard records managers describe it as “holiday work” – work that they’ll get during the quiet periods. Sensible in theory, but in practice it means disposal cycles don’t run on a schedule, they run on availability.
‘When in Doubt, Retain It’ Creates Its Own Risks
The logic behind over-retention is understandable. When disposal is irreversible and the consequences of destroying something prematurely are serious, retaining can feel like the responsible choice. But over-retention carries its own costs and compliance consequences that aren’t always accounted for.
- Storage costs continue to accumulate. Victorian councils spend an average of more than $150,000 per year on third-party records storage services. A meaningful portion of that figure, in most cases, represents records that have already passed their authorised disposal trigger. Those costs don’t reduce on their own. They continue until an active disposal decision is made.
- Privacy exposure increases with retention. The Privacy and Data Protection Act 2014 doesn’t frame this as a best-practice recommendation. It actually prohibits over-retention. Information no longer needed for the purpose for which it was collected must not be retained unnecessarily. For councils holding personal records past their RDA minimum without a documented basis, that requirement is already being breached. The RDA defines the floor. The Act defines the ceiling. Records held past the minimum without a valid basis are on the wrong side of both.
- Audit exposure grows with the backlog. Every record held past its retention period is another record added to the backlog already in storage. What starts as a manageable volume becomes a much larger one, and the larger it gets, the harder it is to know what’s there, what’s eligible, and where to start. A council that couldn’t readily account for its storage holdings last year is in a worse position this year, and will be in an even worse position again next year unless something changes. The backlog doesn’t pause while everything else is being managed.
The Compliance Risk Most Councils Don’t Expect
Once PROV RDA minimum retention periods are met, records can be lawfully disposed of. However, PROV RDA’s don’t set a firm obligation to dispose of those eligible documents. Local councils that opt to simply keep records could be exposing themselves to a growing compliance risk.
The compliance exposure isn’t exactly the retention past the RDA minimum per se. It’s a specific, identifiable gap: records held past the minimum period without a valid basis, like an active FOI or documented historical significance. The records are simply being held because disposal hasn’t been actioned. That gap exists in most councils’ records functions right now and it grows with every year of inaction. And it is exactly the gap that a well-managed records program exists to close.
Compu-Stor’s experience working with Victorian councils is that the risk from over-retention tends to be overlooked. Teams are primarily focused on avoiding premature disposal. Both risks are real and present in most council records functions. A well-managed records function stays inside the authorised window on both sides.
What a Managed Disposal Process Looks Like
Every council’s retention and disposal framework will look different in practice. The right approach depends on factors specific to each organisation, including the size of the records function, available headcount, existing data governance frameworks, how records are currently stored and indexed, and how much of the backlog predates digitisation work. A council running a lean team with a large legacy archive will build a different process to one with established EDRMS infrastructure and a smaller physical footprint.
That said, a compliant, documented disposal decision requires the same five elements regardless of scale:
- No disposal exclusions. Verify that no disposal exclusion applies. The RDA does not authorise disposal of records that are reasonably likely to be required as evidence in current or future legal proceedings, that are subject to an active FOI request, audit, or investigation not yet finalised, or that are covered by a disposal freeze applied by the government or the organisation.
- A confirmed disposal trigger. The specific event that started the retention period running (matter closure, end of financial year, council election, etc.), and evidence that it has been met for the records in question.
- A current RDA reference. The specific RDA Class that authorises the action.
- Authorised officer sign-off. Formal approval from an officer with authority to make the disposal decision.
- A disposal certificate. Documentation recording what was destroyed, when, the authority cited, and the officer who approved it. This is what makes the decision defensible under review.
Compu-Stor’s PROV RDA Finder is a guided, interactive tool designed specifically for Victorian council records managers. Rather than downloading a schedule and working through the hierarchy manually, our Finder provides an interactive guide that allows you to manually click through Function, Activity and Class designations, or search based on a keyword.
For councils wanting to increase productivity, Compu-Stor provides a complete, PROV-compliant pathway from digitisation through to certified physical destruction, with full chain-of-custody documentation and a disposal certificate for your records. Get in touch to find out more.
The RDA Finder is designed to support retention decisions and should be used as a guide. For complex or edge-case record types, we recommend confirming the outcome with your Records Manager or contacting PROV directly.
A Clearer Path Through the Backlog
Addressing a backlog of over-retained records doesn’t have to be a separate project layered on top of everything else. Compu-Stor provides services designed specifically for Victorian councils managing physical records held in third-party storage, on-site, or both. Rather than treating digitisation and disposal as separate workstreams, we step through the full record lifecycle: retrieval, scanning to PROV-compliant standards, disposal trigger confirmation, physical destruction, and the issuance of a disposal certificate for each batch. Get in touch to start a conversation.
This guide is intended as general guidance. For complex records or edge-case situations, we recommend confirming disposal decisions with your Records Manager or contacting PROV directly.
