Mibowork Data Retention and Deletion Policy

Mibowork Data Retention and Deletion Policy


Mibowork Data Retention and Deletion Policy

Version 1.1 – Updated Policy (No Reference to Backup Vault Policy)

Effective Date: 01/09/2025 | Owner: IT Security & Compliance | Approved By: CEO

1. Executive Summary

This policy establishes the principles, responsibilities, and retention periods that govern how Mibowork retains, archives, and securely destroys data. It ensures compliance with Australian legislation, ISO/IEC 27001:2022, client contractual requirements, and Mibowork’s Information Security Management System (ISMS).

The purpose of this policy is to minimize data retention risk, ensure lawful handling of personal information, and demonstrate transparency to clients and auditors regarding Mibowork’s data lifecycle practices.

2. ISMS Framework Linkage

This policy supports the Mibowork Information Security Management System (ISMS) and is supported by the following documents:

  • Certificate of Data Deletion Template: Confirms secure destruction and evidence of completion.
  • Access Control Policy (INF-AC-2025-01): Defines privilege management and access review cadence.
  • Incident Response Plan: Provides procedures for event logging and evidence preservation.
  • Data Classification Policy: Defines how data is categorized and protected based on sensitivity.

3. Policy Statement

Mibowork will retain data only for as long as it is needed for legitimate business, legal, or regulatory purposes. Once data is no longer required for its original purpose, it will be securely deleted or de-identified.

4. Retention Classification Model

Retention periods are established based on data classification, regulatory obligations, and operational needs. Retention schedules apply regardless of data format or storage location.

Data Category

Retention Period

Legal / Regulatory Basis

Destruction Method

Client / Customer Data

Contract term + 90 days

Privacy Act 1988 (Cth); ISO 27001 A.8.10

Secure deletion / Certificate of Data Deletion

Financial Records

7 years

Corporations Act 2001; Taxation Administration Act 1953

Secure deletion / Shredding (paper)

Employee Records

7 years post-employment

Fair Work Act 2009

Secure deletion / Shredding (paper)

Security Logs

1–7 years (risk-based)

ASD Essential 8; ISO 27001 A.5.30

Secure deletion with audit trail

Operational Data

As required for business continuity (maximum 12 months)

ISO 27001 A.8.13

Secure deletion / Archival purge

5. Secure Deletion Process

Deletion of data follows a structured and auditable process. Upon expiration of the retention period or a valid client request, Mibowork initiates secure data deletion in accordance with the Certificate of Data Deletion process.

Steps include:
Verification of request and data ownership.
Identification of affected systems and data sets.
Secure purge using Microsoft 365 Purview or approved deletion tools.
Dual-authorization of deletion by IT Security and Data Owner.
Issuance of Certificate of Data Deletion to the client.
Retention of deletion logs for at least 12 months for audit readiness.

6. Roles and Responsibilities

Data Protection Officer (DPO): Oversees enforcement and reports on compliance.
IT Department: Implements technical controls and executes deletion procedures.
Department Managers: Ensure team compliance with retention schedules.
Legal Counsel: Advises on legal holds and approves exceptions.
Security Team: Verifies and co-signs deletion evidence.

7. Compliance, Monitoring & Review

Compliance with this policy will be verified through regular internal audits, automated monitoring, and evidence-based review. Exceptions must be documented and approved by senior management. Legal holds override retention schedules until formally released.

INTERNAL USE ONLY – Do not distribute outside Mibowork

    • Related Articles

    • The Psychosocial Risk Management Opportunity

      From Harm to High Performance: The Awaiting Opportunity of Psychosocial Risk Management The psychosocial environment is a critical strategic priority for organisational success. When managed effectively, it drives underlying dynamics and provides ...

    • From Fear to Confidence Whitepaper

      From Fear to Confidence: Debunking Common Misconceptions with Psychosocial Risk Management Leaders across industries are increasingly aware that psychosocial risk management is both a compliance imperative and a key driver of organisational health. ...

    • Beyond Harmful Behaviour Bias

      Beyond Harmful Behaviour Bias: Targeting Upstream Psychosocial Risks to Reduce Harm Workers’ compensation data is often used to identify leading causes of psychological injury in Australia. However, the way the system classifies claims tends to ...

    • A Next Generation Occupational Hygiene Approach Appropriate for the Psychosocial Environment

      Mibowork Pty Ltd ABN 68 640 006 980 321 Indooroopilly Rd Indooroopilly QLD 4068 support@mibowork.com.au Quantitative Psychosocial Risk Assessment: A Brief History and Next Generation Requirements This paper reflects on the evolution of quantitative ...