Does Telco data retention — 2 years (Part 5-1A Telecommunications Act) apply to businesses with 1–5 employees?

Yes (1–5 employees, turnover $100K–$1M).

Who must comply with Telco data retention — 2 years (Part 5-1A Telecommunications Act)?

The applicability test for Telco data retention — 2 years (Part 5-1A Telecommunications Act) (ACMA), computed across 35 industries, 9 business structures and 6 size bands.

Short answer: Some businesses

Applies when the business has industry: Telecommunications carriers / CSPs.

What the obligation is

Carriers + CSPs must retain telco metadata for 2 years.

Part 5-1A of the Telecommunications (Interception and Access) Act 1979 (s 187A) requires a service provider that operates a relevant service to keep specified telecommunications data about every communication carried by the service. The data set in s 187AA covers subscriber and account information, the source and destination of a communication, its date, time and duration, the type of communication and service, and the location of equipment at the start and end of the communication. Providers are not required to keep the content of communications, subscribers' web browsing history, or data about over-the-top services carried by another provider. Retained data must be encrypted and protected from unauthorised access (s 187BA), and the Privacy Act 1988 applies to retained data as if the provider were an organisation under that Act (s 187LA). A provider may operate under an approved data retention implementation plan or seek an exemption from a Communications Access Coordinator.

The applicability test

Applies when the business has industry: Telecommunications carriers / CSPs.

How the regulator frames it: Carriers, internet service providers and providers of any service declared by the Minister, where the service carries communications by electromagnetic energy and the provider owns or operates infrastructure in Australia for its relevant services. Broadcasting services are excluded, and services provided only to an immediate circle or within a single area are excluded unless declared (s 187B).

What triggers it: Operating a relevant service under s 187A(3) that carries communications for customers.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Which industries are in or out

Outcome across the 35 industries Rules Mate maps (1 of 35: yes; 34 of 35: no).

Industry	Answer
Telecommunications carriers / CSPs	Yes
No	34 other industries

Business structure and size

Structure does not change the answer in telecommunications carriers / csps: for every structure the answer is "yes".

Size does not change the answer in telecommunications carriers / csps: at every size band the answer is "yes".

Worked examples

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

Pty Ltd company in telecommunications carriers / csps with 6–19 employees, turnover $1M–$3M: applies. Industry: Telecommunications carriers / CSPs.
Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires industry: Telecommunications carriers / CSPs.

What you must do, and when

When due: Ongoing. Subscriber and account information must be kept until 2 years after the account closes; all other required data for 2 years after it came into existence (s 187C).
Frequency: Ongoing
Evidence to keep: Data retention design mapping each s 187AA data item to the systems that create and store it; retention schedules (2 years, or 2 years after account closure); encryption and access controls over retained data; any approved data retention implementation plan or Communications Access Coordinator exemption; Privacy Act handling procedures for retained data.
Status: Current
Priority: High

Penalty for not complying

Maximum penalty: Section 187A(1), and the duty to comply with an approved implementation plan (s 187D(a)), are civil penalty provisions for the purposes of the Telecommunications Act 1997, whose Parts 31 and 31B provide for pecuniary penalties and infringement notices.

Criminal liability

Breaches can be prosecuted as criminal offences, not only civil contraventions.

Audit or assurance level

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

Obligations with the same applicability test

If this obligation applies to you, so do these 4: the engine uses the same rule for each.

What usually applies alongside it

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

Where it sits in the corpus

Rules Mate tracks 5 published obligations tagged "telecommunications", 0 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority and carries criminal liability, and is an ongoing duty.

Regulator, legislation and tools

Regulated by Australian Communications and Media Authority.

ACMA: Telecommunications, broadcasting, radio, and online content regulator. Administers Spam Act, Do Not Call Register, telecom consumer codes.

Australian Communications and Media Authority

Telecommunications Act 1997: Federal telecom regulation.

Telecommunications Act 1997

Free tools that help with this obligation:

Compliance calendar builder

Run the compliance journeyAnswer a short questionnaire about your business and get the obligations that apply to you, with the reason each one applies.

Questions

Who must comply with Telco data retention — 2 years (Part 5-1A Telecommunications Act)?: Applies when the business has industry: Telecommunications carriers / CSPs.
Does Telco data retention — 2 years (Part 5-1A Telecommunications Act) apply to sole traders?: Yes. Looking in telecommunications carriers / csps and every size band, the engine's answer for a sole trader is: yes.
Does Telco data retention — 2 years (Part 5-1A Telecommunications Act) apply to businesses with 1–5 employees?: Yes (1–5 employees, turnover $100K–$1M).
When is "Telco data retention — 2 years (Part 5-1A Telecommunications Act)" due?: Ongoing. Subscriber and account information must be kept until 2 years after the account closes; all other required data for 2 years after it came into existence (s 187C).

Sources

Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.