Australian data residency and the six-year hiring record
Two data questions decide most Australian HR technology reviews: where does candidate data live, and how long do we have to keep it. The answers pull in opposite directions — minimise the data, but keep the decision trail for six years — and the way to satisfy both is to make the decision trail small.
- APP 8 makes you accountable for a cross-border recipient’s handling unless a narrow exception applies — offshore processing is permitted, but it is your obligation, not the vendor’s.
- Data residency is a contractual and architectural fact, not a marketing claim: ask which region, which sub-processors, and where backups and model inference run.
- Hiring decision records need a six-year floor because a rejected applicant has six years under s.544 of the Fair Work Act.
- Six years of full video recordings is disproportionate; six years of transcripts, scores and evidence maps is not.
- Separate the decision record from the raw media and you can satisfy retention and minimisation at once.
APP 8: offshore is allowed, but the accountability stays with you
Australian privacy law does not require candidate data to stay in Australia. What APP 8 does is make the disclosing entity accountable: before disclosing personal information to an overseas recipient you must take reasonable steps to ensure the recipient does not breach the APPs, and in most cases you remain answerable for their acts and practices as if they were your own.
That flips the usual procurement conversation. The question is not "is offshore processing allowed" — it is — but "am I willing to answer for what happens to this data in that jurisdiction". For high-volume interview data, including transcripts of candidates discussing health, caring responsibilities and work history, most Australian enterprises decide they are not.
What "Australian data residency" actually has to mean
The phrase appears on a great many vendor websites and means materially different things. Five specific questions separate a residency claim from a residency architecture.
- 01Which region is primary storage in, named precisely, and can it be contractually pinned rather than defaulted?
- 02Where do backups and disaster-recovery replicas live? Residency that lapses in the backup tier is not residency.
- 03Where does model inference run? This is the question vendors most often cannot answer, because the transcript leaving the region to reach a model provider is a cross-border disclosure even if storage never moves.
- 04Which sub-processors touch the data, in which countries, and does the contract require notice before that list changes?
- 05Where does support access happen from? An engineer in another jurisdiction opening a record is a disclosure.
For government and critical-infrastructure buyers, add the assurance layer on top: hosting in an assessed environment, and evidence of the assessment. Ask for the current status rather than an aspiration, and read the scope statement rather than the badge.
The six-year floor, and why most stacks get it wrong
The retention side is where Australian practice diverges sharply from the global default. Because a rejected applicant is not caught by the 21-day dismissal clock, the general six-year limitation period in s.544 of the Fair Work Act applies to a general protections claim about a screening decision.
Meanwhile the standard ATS retention default sits at twelve or twenty-four months, and most global vendors set aggressive deletion schedules for sound privacy-minimisation reasons that were written with other jurisdictions in mind. Applied unmodified in Australia, that setting deletes your defence and leaves the reversed burden of proof standing against you.
| Artefact | Retention posture | Why |
|---|---|---|
| Video and audio recording | Short — months, and only where genuinely needed | High-sensitivity, high-volume, and rarely the thing that proves anything a transcript does not |
| Interview transcript | Six years | The evidence behind every score lives here; without it the scores are unexplainable |
| Competency scores and evidence map | Six years | The core of the s.361 defence — what was assessed and what supported it |
| Rubric, rule pack and model versions | Six years | Proves which standard applied on the day, not the one you use now |
| Human reviewer identity and rationale | Six years | The witness evidence for a decision the reversed onus makes you prove |
| Adverse-impact analysis for the requisition | Six years | Evidence that you monitored, and what you did when a threshold was crossed |
Making six years proportionate
The reason retention debates stall is that people imagine keeping everything for six years. Keeping full video for six years genuinely is disproportionate under APP 11 minimisation thinking, and no privacy officer will sign it.
The resolution is structural. Separate the decision record from the raw media at capture time. The decision record — transcript, scores, evidence citations, rule versions, reviewer and rationale — is small, textual, and exactly what a claim needs. The raw media is large, sensitive and mostly redundant once the transcript and evidence citations exist.
- Retain the decision record for six years; delete raw media on a short cycle unless a specific matter is live.
- Make retention configurable per artefact class, not one global slider.
- Support legal hold, so a live matter suspends deletion for the affected records only.
- Log deletions. Being able to show what was deleted and when is itself part of the defence.
- Disclose the split in your privacy policy and collection notice so candidates are told accurately.