- Removal manifest
- Sheet 5 of 7
- Item 4: the records
Keeping business records through a hosting move
Electronic business records have to survive a change of host in a form the ATO can still read: its ruling on electronic records says “If your system changes over time, the original data must still be capable of being reconstructed”, and that records are generally kept for five years. Records in the cloud are under the same rules as paper ones, and the ruling says it is your responsibility to keep your electronic records secure, accurate and maintained, wherever they sit.
The ATO is the official place to check, and it suggests asking your registered tax or BAS agent, or the ATO itself, if you are not sure how its record-keeping information applies to you.
01What counts as a record on a hosted site
The ATO says a business must keep records of all transactions relating to its tax, super and registration affairs as it starts, runs, sells, changes or closes, and that a record explains those transactions. Its ruling on electronic records, TR 2018/2, treats business done over the internet like any other business, and sets a minimum for each e-commerce transaction record: the date, the amount and the character of the transaction.
For a website that takes orders or bookings, that points to the order history in the site’s database, not only the invoices in the accounting software. Which of a site’s files are tax records is a question for your own agent; the move is the moment to find out.
02The four requirements, read for a move
TR 2018/2 says record keeping must meet four requirements. The first column quotes them in the ruling’s order. The other two columns are this guide’s reading of what a change of host does to each, with the ruling’s own detail where it gives one.
| The requirement | What a move puts at risk | Before the old account closes |
|---|---|---|
| “Records must not be altered or manipulated, and must be stored in a way that restricts the information from being altered or manipulated.” | An export and re-import can change how data is held. The ruling adds that a change of system over time must still leave the original data able to be reconstructed. | A complete export of the original data, kept alongside whatever the new system holds. |
| “Generally, they must be retained for five years after the records are prepared or obtained, or the transactions are completed, whichever occurs later.” | Records that stay behind on a closed account. The ruling also asks you to keep information about any routine procedures you have for destroying electronic records. | The records you need for the retention period, moved somewhere you control. |
| “They must be capable of being retrieved and read by us when required.” | A format only the old software can open. The ruling lists system documentation, encryption keys and a means of access, and data that can be extracted and converted into a standard data format. | An export in a standard format, with the keys and passwords to open it. |
| “They must be in English, or in a form that we can access and easily convert to English.” | Exports that use codes or labels only the old system understood. | Labels and field names that still make sense on their own. |
The ATO’s plainer overview gives an example of a standard format: it says to make sure the ATO can extract and convert your data into one, such as Excel or CSV.
03When the five years start, and when they run longer
The ATO says the five years generally run from the later of two dates: when the record was prepared or obtained, and when the transaction or act it relates to was completed. It names exceptions with different start dates, such as fringe benefits tax and employee super records. Some records must be kept for longer. For depreciating assets and capital gains tax assets, for instance, the ATO says the record is generally kept for as long as you have the asset and then for five years after you sell or otherwise dispose of it.
Other bodies have their own periods. The ATO’s overview points out that ASIC requires companies to keep records for seven years, and suggests checking the requirements of every organisation you deal with.
04The ATO’s access to records in the cloud
TR 2018/2 also explains how the ATO gets at electronic records. It prefers to ask for cooperation, but its powers let it require you, by written notice, to produce electronic documents you have custody or control of, for a taxation law’s purposes. Three points from the ruling bear on a move:
- Reasonable facilities and assistance can extend to providing login codes, keys (including encryption keys) and passwords.
- Where your records are in the cloud and immediately accessible to you, the ATO says it can use its access powers to obtain them.
- If the cloud provider is offshore, the ATO may also seek the records under a double tax agreement or its offshore information notice power.
Read together, these points suppose that you can reach your own records. An account at a host you have left, with a password nobody kept, is the opposite of that.
05Keeping them safe on the other side
Once the records are with the new host, or on your own storage, the ATO’s guidance on safe and secure records applies. It says you must be able to show you control who can get into your computer, with passwords as one way, and recommends regular backup copies of electronic records kept in a safe place, preferably away from your business premises, or in cloud storage. The access side of the move is covered in a safe cutover; personal information inside those records has its own rules in getting your data back, and deleting it.