How long should you keep enquiry details? A retention and deletion plan

Start with the record, not one blanket deadline

An unconverted website enquiry is not the same record as an invoice, a signed agreement or an unsubscribe instruction. Keeping every field forever because some business records must be retained creates a growing pile with no clear purpose. Deleting everything after a short fixed period can remove evidence you still need. OAIC guidance says organisations covered by the Australian Privacy Principles must take reasonable steps to destroy or de-identify personal information once it is no longer needed for a permitted purpose, subject to the stated retention exceptions. First check whether the Privacy Act applies to your business. Small-business exemptions have exceptions; size alone is not a complete assessment.

Keep readingStart with the privacy basics for enquiry forms

Write a retention schedule with these columns

Use one row for each record category. Record its purpose, the event that starts the retention clock, the period and its reason, the person responsible, every system containing a copy, and the deletion or de-identification method. Put the decision date and next review date beside it.

The ATO says most business records need to be kept for five years, with different start points and exceptions. That is not a rule to keep every unsuccessful lead or every attachment for five years.

• Unconverted enquiry: start from the last meaningful contact; choose and justify a period that fits the enquiry cycle.
• Customer transaction: identify the actual tax, contractual and other retention duties before choosing a deletion date.
• Marketing preference: retain the minimum suppression information needed to respect a person's request rather than re-importing them as a new prospect.
• Spam or test submission: set a short operational review process, with any security evidence handled separately.

Map the copies before the first deletion run

Follow one test enquiry from the website to its destinations. It may create a form-plugin entry, an email notification, a CRM contact, a sales spreadsheet and a downloaded attachment. Include agency or automation platforms and ask who can delete their copies. Document how backups age out and what happens if an old backup is restored. Where a backup cannot be selectively altered safely, control access, restrict its use and make sure a restoration does not silently put deleted records back into day-to-day marketing. Check the provider's actual capabilities and your applicable obligations.

A worked example for a long sales cycle

Imagine a commercial installer whose prospects sometimes return with a revised project scope. The owner chooses a documented review point after the enquiry has closed, rather than deleting the record simply because no sale happened that month. The salesperson records the closure event; the administrator checks for a dispute or another retention reason before deletion. If the lead became a customer, the transaction record moves into the appropriate customer-record category. The enquiry's duplicate spreadsheet export does not automatically acquire an indefinite purpose just because an invoice exists elsewhere. This is an illustrative process, not a recommended universal retention period.

Run a small, accountable deletion batch

Start with a reviewed list and sample a few records across the connected systems. Confirm the correct identity, retention trigger and absence of a hold before deleting. Separate the list used to approve a deletion from the personal details being removed; do not create another permanent full-data export as proof. Record the run date, record category, systems covered, count and operator. Keep exceptions in a short queue with an owner and reason. Stop if a deletion targets the wrong person or if a connected tool unexpectedly removes related customer information.

Keep readingMap every place an enquiry lands

Make retention part of the enquiry workflow

Give new enquiry types a retention row when they are introduced. Review the schedule when you change CRM, form tools, legal obligations or the way you use the information. Assign one person to check that the written process matches what the tools actually do. The useful outcome is a repeatable decision about necessary records and unnecessary copies, rather than an impressive-looking policy nobody can carry out.