A scheme most businesses never see
Every phone call, text message, email and app session your business relies on generates a trail of information: who communicated, when, from where, for how long and using which device. Since late 2015, Australian telecommunications providers have been legally required to hold two years of that trail so that law enforcement and security agencies can draw on it during investigations. The obligations were introduced by the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015 (Cth), which amended the Telecommunications (Interception and Access) Act 1979 (Cth) (the TIA Act), and commenced on 13 October 2015.
The scheme exists because, before 2015, providers kept billing and call records on their own commercial schedules. Agencies could not rely on consistent data being available when a serious investigation began. The scheme standardises what must be kept, for how long, and who may ask for it. This article walks through the moving parts: what counts as telecommunications data, who must store it, which agencies can access it and under what conditions, and the safeguards built in to limit misuse. The topic matters to your business twice over. Your own communications are part of the dataset, and if your business provides any kind of communications service, you may be one of the companies legally obliged to retain the data in the first place.
What "telecommunications data" actually includes
The scheme does not define what must be retained in the abstract. Instead, s 187AA of the TIA Act sets out a table of the kinds of information a service provider must keep. The categories are:
- Subscriber identity: names, addresses, billing and payment details, contact information, identifiers for the account or device, and the status of the service.
- Source and destination: the identifiers of the account, service or device a communication was sent from, and the account, device or service it was sent to, forwarded to or routed towards.
- Timing: the date, time and duration of a communication, including the time zone, accurate enough to identify the communication.
- Type: the kind of communication, such as voice, SMS, email, chat or social media, and the kind of service used, such as ADSL, Wi-Fi, VoIP or mobile data.
- Location: where the equipment or line used to send or receive the communication was located, including the cell towers or Wi-Fi hotspots involved.
What the table does not include matters just as much. The contents or substance of a communication are outside the scheme entirely: s 172 of the TIA Act makes it explicit that the access provisions never permit the disclosure of what was actually said or written. Web browsing history is not among the retained categories either. None of this makes the dataset harmless. Knowing who you called, when, from where and for how long can reveal a great deal about your movements, your contacts and your commercial relationships, even when the words themselves are off limits.
Who has to keep the data
The retention obligation in s 187A of the TIA Act falls on service providers that operate a "relevant service". That covers carriers, internet service providers, and other kinds of services declared by the Minister. The obligation is not confined to the big telcos: if your business operates a communications service, including a phone system, messaging platform or data network, it is worth checking whether your service has been captured by the scheme, because the Minister can declare additional service types.
The retention period is two years. Under s 187C of the TIA Act, subscriber account information must be kept until two years after the account is closed, and all other data until two years after it came into existence. Providers are free to keep information longer, so there is no automatic destruction obligation. Some providers are removed from the obligation altogether or in relation to particular services under s 187B, and providers with approved data retention implementation plans can phase their compliance in, but the default position for a captured provider is a standing, two-year, system-wide retention obligation that applies to every customer.
Who can access it, and how
The access side of the scheme is deliberately narrower than the retention side. Six sets of actors are involved:
- Service providers: hold the data and must hand it over when a valid authorisation is notified to them.
- Enforcement agencies: bodies with law enforcement functions, including the AFP and state and territory police, can authorise access to existing data themselves.
- Criminal law-enforcement agencies: a narrower class that can also authorise ongoing, prospective collection.
- ASIO: the security organisation, which operates under its own authorisation provisions.
- Issuing authorities and the Attorney-General: involved only where a warrant is required, such as for content interception and journalist information warrants.
- The Commonwealth Ombudsman: inspects agency records to check that the scheme is being complied with.
The default: an internal authorisation, not a warrant
The striking feature of the scheme is that most access never goes near a court. Under s 178 of the TIA Act, an authorised officer of an enforcement agency can authorise the disclosure of existing telecommunications data where satisfied it is reasonably necessary for the enforcement of the criminal law. The authorisation takes effect when the provider receives notification of it under s 184, and the provider must then comply. Related provisions cover locating missing persons (s 178A) and the enforcement of laws imposing pecuniary penalties or protecting the public revenue (s 179), which is how regulators pursuing fines and penalties can obtain data.
Criminal law-enforcement agencies and prospective data
A second tier applies to criminal law-enforcement agencies, which are listed in s 110A of the TIA Act. The list includes the AFP, state and territory police forces, the National Anti-Corruption Commission, the Australian Criminal Intelligence Commission, ASIC, the ACCC, and the various state anti-corruption bodies. Under s 180 of the TIA Act, an authorised officer of one of these agencies can authorise the disclosure of data that comes into existence while the authorisation is in force, which is prospective collection, in addition to data that already exists. The threshold is higher: the disclosure must be reasonably necessary for the investigation of a serious offence, or of an offence punishable by imprisonment for at least three years. The authorisation runs for up to 45 days and must be revoked once it is no longer required.
ASIO and foreign agencies
National security access sits outside the criminal law framework. Under s 176 of the TIA Act, senior ASIO officers can authorise access to telecommunications data in connection with the organisation's security functions, with no court involvement. Foreign law enforcement is dealt with separately in Division 4A of Part 4-1: the AFP can authorise access to support foreign investigations, but only with the prior approval of the Attorney-General.
Content is a different regime entirely
The internal authorisation machinery only reaches the metadata. Intercepting a live call or message requires a warrant under Part 2-5 of the TIA Act, and accessing stored communications such as unread messages requires a stored communications warrant under Part 2-6. Both regimes are administered by issuing authorities rather than by the agencies themselves, and the tests are considerably stricter. If an agency wants the words of a communication, the internal authorisation path is not available to it.
The safeguards built into the scheme
Because the authorisation system is internal, the Act compensates with a set of structural safeguards:
- The content exclusion: The access provisions never reach the substance of a communication, and retaining content is not part of the scheme at all.
- Journalist information warrants: Introduced in 2021, Division 4C of Part 4-1 requires an agency to obtain a journalist information warrant before accessing data that would identify a journalist's source. Warrants are issued by the Attorney-General for ASIO requests and by a Part 4-1 issuing authority for enforcement agencies, run for up to 90 days, and are subject to a public interest test that weighs the investigation against the confidentiality of the source. Public Interest Advocates, declared by the Prime Minister under s 180X, can make submissions on whether a warrant should issue.
- Ombudsman oversight: Chapter 4A of the TIA Act gives the Commonwealth Ombudsman powers to inspect the records of agencies and determine the extent of compliance with the access provisions, and to investigate complaints.
- Offences: Division 6 of Part 4-1 creates offences for unauthorised disclosure and use of telecommunications data, so the permission structure cuts both ways: agencies and providers who step outside it are themselves exposed.
Where the scheme bites in practice
The most common practical problems sit on the provider side. A captured business faces a standing compliance burden: systems that retain the right categories for two years, records of every authorisation it receives, and the risk of offences for wrongful disclosure. The trap is the reverse of what most people assume. The risk is not refusing an agency too often, but disclosing too readily. A provider that hands over data on a defective authorisation has still made a disclosure, and needs to be able to show the authorisation it relied on was valid on its face.
On the employer side, the scheme does not give businesses access to their own staff's communications. Reading a staff member's messages or monitoring live calls still engages the interception and stored communications warrant regimes, and doing so without authority can be an offence, even on a device the business owns and pays for. The retention scheme changes what the telco holds, not what an employer may lawfully inspect.
For journalists and media businesses, the journalist information warrant regime exists because source identification is treated specially. If an agency wants data that would expose a source, it must clear the warrant hurdle first, and a Public Interest Advocate gets a chance to make submissions. That is a genuine layer of protection, but it only works if the people affected know the regime exists and can challenge what happens outside it.
There is also a wider point worth remembering. The 2015 reforms deliberately narrowed access: before the Data Retention Act, a broader range of agencies could seek data directly, and the amendments restricted direct access to the classes of agency described above. That design choice is why the current scheme draws such a clear line between what is retained (broad, automatic, two years) and who can ask for it (a fixed list of agencies, internal authorisations, specific thresholds).
When you need a lawyer
The scheme produces three distinct situations where legal input is worth having. If your business is a service provider, a lawyer can determine whether your service is captured, design a compliant retention approach, and set up the record keeping that protects you when an authorisation arrives. If your business is investigating wrongdoing, whether internally or through regulators, a lawyer can advise on what data can lawfully be obtained, how to obtain it, and whether the evidence will hold up. And if your business or your journalists are the subject of access, a lawyer can verify the authorisation or warrant, raise concerns with the agency or the Ombudsman, and engage with the journalist information warrant process before a disclosure happens. In each case the work is mostly about the paperwork: checking that the authorisation is valid, the thresholds are met and the records are in order, which is far cheaper than unpicking an unlawful disclosure after the fact.
The balance sits with what is kept, not who asks
If there is one feature of this scheme to hold on to, it is the asymmetry between retention and access. Retention is broad, automatic and invisible: two years of metadata on every customer, held by every captured provider, with no individual consent involved. Access is controlled, but by internal authorisations and a handful of external checks rather than by courts. That means the practical protections are the categories of data itself, the serious-offence thresholds, the 45-day and 90-day caps, and the Ombudsman's inspection role, not any day-to-day judicial oversight. For a business, the question is which side of the line you sit on. If you hold the data, your obligations are ongoing and need to be built into your systems now. If your data is being sought, the authorisation process itself defines what you can question and challenge. An early conversation about which side you are on is straightforward, and it is the difference between shaping your compliance position and discovering it after a disclosure has already been made.