Supporting Materials

DSPs can determine how they manage customer data retention and deletion from trial software.

Trial software is not intended for business record-keeping purposes (whilst it is a trial version) and should not connect to ATO or superannuation systems via Application Programming Interfaces (APIs). DSPs may delete all data immediately or at the end of the trial period.

DSPs may have a limited ability to assist customers with accessing and retrieving their data from unsupported software products. 

When sunsetting software products, DSPs can follow the best practice guidance for inactive and non-paying customers. Following the guidance, DSPs should:

• Retain customer data for at least 12 months
• Allow customers to access and retrieve their data in a human-readable format
• Take reasonable steps to contact customers before deleting any data

DSPs covered by the Privacy Act must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. The Australian Privacy Principle (APP) 11 contains detailed information on the security of personal information. 

DSPs may also need to consider other security and privacy requirements for specific records or datasets such as:

• Protecting Tax File Numbers (TFNs) and securely destroying or de-identifying TFN information when it's no longer required
• Following requirements to protect customer information in test environments including under the Information Security Manual (1420) and ISO 27001 (8.31 and 8.33). Ideally, customer data should not be used in test environments.

The ATO's Operational Security Framework (OSF) requires DSPs to keep audit logs for at least 12 months. The OSF outlines that backups must be fully encrypted and keys must be properly managed. 

Outside the OSF and other industry requirements that may apply, DSPs can choose an approach to backing up data that best suits their environments. It's important to note that backup data should be kept for longer than needed by a DSP. 

DSPs may consider security controls to better protect back up data, such as encryption at rest, which is often an existing feature in many cloud hosting providers that DSPs can turn on. 

More general backup information can be found in the Australian Information Security Manual.  

DSPs may provide customers with custom implementations. The terms of use between the DSP and customer for these environments may create new data retention requirements that need to be managed separately. 

The individual or business paying for a software product or services of a Digital Service Provider (DSP). For this document, "customer" describes taxpayers in the context of their relationship with a DSP. 

The data or artefacts a customer enters into their software that ultimately form broader tax, employee obligation, invoicing, business registry or superannuation records. 

Digital Service Providers, also known as DSPs, create, sell and use software solutions to securely capture, transmit and share information and are commonly used in the day to day management of a business and its employees. Common examples include tax and accounting or payroll software, point of sale systems, superannuation and contributions management systems, eInvoicing software and eCommerce platforms. 

Customers who are inactive and non-paying that have ceased their commercial relationship with a DSP. The following could be considered as examples that signify the end of the commercial relationship:

• The payment method was declined and retried with failure
• Contract not renewed or extended
• Cancelled subscription
• Customer moves to another product
• Death, medical impairment or retirement of the primary customer
• Tax practitioner loses their registration
• Customer stops trading, goes into liquidation or is found to be fraudulent
• DSP exits the market.

Information created, received or maintained as evidence and as an asset by an organisation or person, in pursuit of legal obligations or in the transaction of business. 

Individuals and businesses with compliance and record-keeping obligations in Australia. This document uses "taxpayer" more generally when describing their legislative or regulatory record-keeping obligations.