Most businesses keep records for as long as the tax office and their accountant tell them to, and then they get rid of them. Registered training organisations are different in a way that quietly breaks the usual assumptions about IT.
Under the Standards for RTOs, a provider must retain records of the AQF certification documentation it has issued for a period of 30 years, and be able to produce them on request. Testamurs, statements of attainment, records of results — the evidence that a person was awarded a qualification — have to survive for three decades after the fact.
Thirty years is not a record-keeping period. It is an archival one, and it deserves to be treated that way.
Why 30 years is a different kind of problem
Consider what does not last 30 years:
- The server. A physical server has a useful life of five to seven years. Cloud platforms are more durable, but the account, the product and the vendor's pricing are not guaranteed to exist in 2056.
- The student management system. SMS vendors merge, get acquired, sunset products and change data formats. A provider that has been operating for 15 years has typically been through at least two.
- The file format. Proprietary database exports and document formats from the early 2000s are already awkward to open. The formats you use today will be in the same position long before the retention period ends.
- The people. Whoever set the system up, knows the export routine, and holds the admin password will not be there. Institutional memory has a much shorter half-life than 30 years.
The common failure is not that a provider loses the records outright. It is that the records technically exist — on an old server in a storeroom, in a backup nobody has tested, or inside a system the organisation no longer has a licence for — and cannot be produced when asked. From a compliance standpoint, a record you cannot produce is a record you do not have.
Not everything is 30 years
The 30-year period applies to certification documentation. Other categories of record an RTO holds — assessment evidence, enrolment information, training and assessment strategies, trainer credentials, complaints and appeals, third-party arrangements — carry their own retention requirements, most of them much shorter, and some driven by funding agreements or state contracts rather than the national Standards.
The practical implication is that "keep everything forever" is not a strategy either. It creates a growing pile of personal information about students, much of it sensitive, that you are obliged to protect for far longer than you are obliged to keep it. Retention design means knowing which category each record belongs to, and treating them differently.
What a 30-year design actually looks like
It is not complicated, but it does have to be deliberate.
Separate the archive from the live system. Certification records should exist as a defined, durable set that is *not* dependent on the student management system continuing to exist. Exporting them from the SMS into a vendor-neutral format on a schedule — and confirming the export is complete — means a change of vendor is a migration, not a crisis.
Choose formats that will still open. PDF/A exists precisely for this purpose: it is a version of PDF designed for long-term preservation, with fonts embedded and no external dependencies. Plain structured data (CSV, JSON) for the index. Avoid anything that requires a particular application to read.
Hold more than one copy, in more than one place. The archive belongs on storage that is independent of the day-to-day systems and geographically separate from them, with at least one copy that cannot be altered or deleted by an attacker who compromises the live environment — immutable or offline. A ransomware incident that encrypts the SMS and the backup together is exactly the scenario that turns a compliance obligation into a compliance failure.
Test retrieval, not just backup. Once a year, pick a qualification issued a decade ago and have someone who did not build the system produce the record from the archive. If they cannot, you have found the problem while it is still cheap.
Plan the migration before you need it. Every five years or so the archive should be moved forward — new storage, checked formats, verified index. Put it in the calendar. The whole point is that this has to outlive the current setup and the current staff.
The student management system is a critical system
The archive protects the long-term obligation. The live system protects everything else. When the SMS is unavailable you cannot enrol, mark attendance, record results, report or issue certification — and for an RTO those are compliance activities, not just operational ones.
That means the SMS deserves the same treatment we give any system an organisation genuinely cannot operate without: understand what it depends on, confirm the backups are real and have been restore-tested, and agree a recovery time that is actually acceptable rather than finding out during an outage. It is the core of how we approach IT for education and training providers, and the backup and continuity design flows directly from it.
The privacy side
Student records routinely contain personal information and, frequently, sensitive information — disability and support needs, welfare notes, health details — often about minors. Whether the Privacy Act 1988 applies to your organisation depends on how it is constituted and funded, and it is worth confirming rather than assuming. Either way the practical controls are the same: limit access to those who need it, review that access as cohorts and staff change, and be able to establish who accessed what. A 30-year archive of qualification records is one thing; a 30-year archive of everything a student ever told you is a liability.
A note on advice
This article describes the framework in general terms. The Standards for RTOs are revised from time to time, funding bodies impose their own requirements, and the specifics depend on your registration and contracts. Check the current Standards and your agreements directly, and treat this as a prompt for that conversation rather than a substitute for it.
What holds regardless of the detail is the design principle: a record you must keep for 30 years cannot depend on any single server, vendor, format or person. Most providers have not built for that, and the ones that find out are the ones asked to produce a record from 2009.
*Last updated: 17 September 2026.*