IM BLOG: Delete with confidence: why defensible disposal is now a cyber security control
For years, organisations treated storage as inexpensive and deletion as dangerous. The result is a familiar landscape of ageing shared drives, duplicate email archives, abandoned collaboration sites, legacy applications and cloud repositories containing information that nobody owns and few people understand. “Keep everything” can feel cautious. In reality, it often transfers risk into the future.
The records profession needs to reframe disposal. It is not the administrative end of the information lifecycle. Done lawfully and consistently, defensible disposal is an active privacy, cyber security and governance capability.
Minimising the attack surface
Cyber security discussions usually focus on preventing intrusion, strengthening identity controls and detecting malicious activity. Those controls are essential, but they do not answer a more basic question: if an attacker gained access tomorrow, how much information would be available to take?
Every obsolete customer file, former employee record, superseded spreadsheet and forgotten attachment can increase the potential impact of a breach. Old information can also be harder to protect because it sits in unsupported systems, inherited file structures or repositories with excessive permissions.
This is where records management and cyber security converge. Security teams work to reduce exposure. Records professionals determine what information has continuing business, legal or historical value and what can be lawfully removed. Neither discipline can fully manage information risk without the other.
The principle is simple: information that no longer needs to exist should not remain available to be breached, misused, misinterpreted or discovered years later without context.
Australian law already connects retention and security
In Australia, Australian Privacy Principle 11 under the Privacy Act 1988 (Cth) requires covered entities to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Where personal information is no longer needed for a permitted purpose, an entity must also take reasonable steps to destroy or de-identify it, unless an exception applies, including where the information forms part of a Commonwealth record or must be retained by law or court order.
The Privacy and Other Legislation Amendment Act 2024 (Cth) reinforced that “reasonable steps” include technical and organisational measures. This matters because retention is not merely a storage setting. It is an organisational decision requiring governance, accountable ownership and evidence that policy is being implemented.
For Australian Government agencies, the Archives Act 1983 (Cth) provides the legal framework for disposal of Commonwealth records. The National Archives of Australia (NAA) makes clear that destruction must be authorised, appropriate, secure, timely and documented. Before destruction, agencies must also check whether information is affected by a disposal freeze, legal proceeding, inquiry or access application.
These obligations show why defensible disposal is different from indiscriminate deletion. Deleting everything is unlawful and destructive. Keeping everything is not compliance either. Mature governance sits between those extremes.
New Zealand carries the same message
Aotearoa New Zealand’s Privacy Act 2020 reaches a similar position through Information Privacy Principle 9: an agency must not retain personal information longer than required for the purposes for which it may lawfully be used.
The Public Records Act 2005 (NZ) adds the public-sector recordkeeping framework. Public offices and local authorities must create and maintain full and accurate records, while disposal requires appropriate authority from the Chief Archivist. Archives New Zealand describes regular authorised disposal as a legal requirement and identifies practical benefits including faster discovery, lower management costs, reduced privacy and security breach risk, and better protection of high-value records.
New Zealand’s Privacy Amendment Act 2025, which introduced Information Privacy Principle 3A from 1 May 2026, also increases transparency when personal information is collected indirectly. That reform is principally about notification, but it reinforces a broader governance truth: organisations need to know what personal information they hold, where it came from and why it remains necessary.
Across both countries, privacy and archives law point in the same direction. Retention must be purposeful, disposal must be authorised and accountability must be demonstrable.
AI makes “keep everything” even less sustainable
Artificial intelligence (AI) raises the stakes. Organisations are understandably interested in applying AI to enterprise information, but an AI assistant connected to sprawling repositories can retrieve content that is outdated, duplicated, sensitive or outside its intended context.
AI does not turn unmanaged information into trusted information. It makes the consequences of poor governance arrive faster.
Large volumes of redundant, obsolete and trivial information can weaken search quality, complicate access controls and obscure authoritative records. Old personal information may also be surfaced in new contexts for which it was never intended. Before connecting AI to a repository, leaders should ask whether the information should still be there at all.
This creates a strategic opportunity for records professionals. Disposal programs can become part of AI readiness by reducing noise, clarifying source authority, improving metadata and ensuring that high-value information is easier to identify. The strongest AI foundation is not the largest possible information estate. It is the most trustworthy and appropriately governed one.
From retention schedules to operational control
Many organisations already have retention and disposal schedules. The problem is that the rules often live in documents while the information lives across Microsoft 365, email, line-of-business applications, file shares, SaaS platforms, backups and outsourced services.
Closing that gap requires a multidisciplinary disposal program. Records and information management should interpret retention authorities and identify evidentiary value. Legal teams should define holds and regulatory constraints. Privacy specialists should test the ongoing need for personal information. Cyber teams should prioritise high-risk repositories and secure destruction methods. Technology owners should automate controls where appropriate and verify that disposal reaches copies, exports and connected systems.
Leaders should expect evidence, not assurances. A defensible program should be able to show:
- which authority or rule supports each disposal action;
- whether minimum retention periods and ongoing business needs have been assessed;
- whether legal holds, inquiries, access requests or disposal freezes apply;
- who approved the action and when it occurred;
- how information was securely destroyed, transferred or de-identified; and
- how exceptions and failures were identified and resolved.
Equally, disposal should not be treated as a one-off clean-up project. Information continues to accumulate. Governance must therefore be repeatable, measurable and embedded into the systems where work occurs.
A new executive question
Boards and executives routinely ask whether data is backed up, encrypted and protected. They should also ask: what information are we holding that we no longer need?
That question changes the conversation. It makes unnecessary retention visible as an exposure rather than an asset. It also positions records professionals where they increasingly belong: alongside privacy, cyber security, legal, risk and technology leaders, shaping how information is governed across the enterprise.
The future of records management is not about preserving everything. It is about preserving what matters, protecting what is required, understanding what is high-value and/or high-risk and disposing of the rest with authority and confidence.
In an era of escalating cyber risk, expanding privacy expectations and AI-powered discovery, deletion is not the opposite of good recordkeeping. Defensible disposal is one of its clearest expressions.
Meet your blog author:
Brandon Voight is a Fellow at the Future Government Institute and Director of Enterprise Information Management - OpenText Australia & New Zealand.
Originally a corporate lawyer, and now with over twenty years of experience in empowering customers through technology, his mission is to help OpenText customers unlock the value of their data, improve information governance, and drive informed decision-making.