WhenToDeletePowered by ScheduleOneSearch the register
Privacy and customersCommonwealthKeep (no period stated)

Marketing consent records

How long do marketing consent records need to be kept in Australia?

Keep forNo period stated
Clock startsNo end point stated
Applies toBusinesses sending marketing emails, texts or calls

General information, not legal advice or permission to destroy a record. Coverage may be incomplete or out of date. Check the official text, other applicable obligations and any investigations, disputes or legal holds before disposal. Get advice for your situation. Terms of use.

Under the Spam Act 2003, businesses sending marketing emails, texts or calls must keep marketing consent records, but the law sets no period. No end point stated.

Evidence of consent to receive commercial emails and texts, and to telemarketing calls to numbers on the Do Not Call Register.

2 provisions in 2 laws apply to these records. Each one is set out below with its own period and start date.

The terms

s 16(5)Spam Act 2003
No period stated
Start not stated
s 11(6)Do Not Call Register Act 2006
No period stated
Start not stated

Conditions and exceptions Caution

Neither Act sets a retention period. Under both, a person who relies on consent bears an evidential burden of showing it (Spam Act s 16(5); Do Not Call Register Act s 11(6)).

The law

Spam Act 2003, s 16(5) · Unsolicited commercial electronic messages must not be sentOfficial text ↗
A person who wishes to rely on subsection (2), (3) or (4) bears an evidential burden in relation to that matter.
Text as at 10 March 2016
Do Not Call Register Act 2006, s 11(6) · Unsolicited telemarketing calls must not be made to a number registered on the Do Not Call RegisterOfficial text ↗
A person who wishes to rely on subsection (2), (3), (4) or (5) bears an evidential burden in relation to that matter.
Text as at 1 September 2021

Other terms that apply to these records

This page covers marketing consent records on their own. The same file is often caught by other laws as well, with different periods and start dates. See why a legal term is not a schedule.

2 records. 2 sets of rules. They don't agree.

One business file can hold all of these at once.

Marketing consent recordsKeepSpam Act 2003, s 16(5) · no end point stated
Personal information no longer neededDestroyPrivacy Act 1988, Schedule 1, APP 11.2, APP 4.3 · no longer needed for any permitted purpose

Now do that for every record your organisation holds, and redo it when the law changes. ScheduleOne has done that work, and keeps it current.

See ScheduleOne →