In July 2026, Group 2 entities, the second cohort of Australian businesses, began their first reporting period under the mandatory climate disclosure regime. The requirements will expand again from July 2027, when smaller businesses known as Group 3 entities are brought into scope. Defined as businesses with more than $50 million in annual revenue, more than $25 million in assets, or more than 100 employees, this cohort represents a significant share of Australia's market and will be the final major group required to comply with the rollout of these rules.

Most businesses will not be captured directly, but they will still feel the effect. From their second year of reporting, larger organisations must disclose Scope 3 emissions, which are generated across their value chain, including by the businesses they buy from. For a smaller supplier, the obligation does not arrive as legislation. It arrives as an email from a major customer, a bank or an insurer asking for numbers, and for the records that support them.

These expanding requirements expose a growing but under-discussed issue: the challenge of managing rising volumes of information with a clear understanding of its purpose, value, provenance, and retention requirements. The risk lies in retaining information indefinitely without knowing why it is held or when it should be reviewed or securely disposed of.

The ‘keep everything’ mindset needs stronger governance

For decades, businesses have retained information as a precaution, even when its future value has been unclear. The result is growing volumes of unclassified records that may no longer serve an active purpose, spread across digital and physical systems. In a smaller business, that can mean shared drives, personal mailboxes, old laptops and a filing cabinet nobody has opened in years.

This is unmanaged data retention: retaining data without a clear understanding of its operational, legal, regulatory or evidentiary purpose; its value to the business; or how long it needs to be kept.

Retention is often necessary. Businesses need reliable records to meet legal obligations, support customers, protect their interests, and make sound decisions. The issue arises when information is retained by default rather than managed deliberately across its lifecycle, creating operational and governance risks.

At an operational level, excess information makes it harder for employees to find the records they need. It adds complexity to systems and can leave organisations managing several versions of the same document across disconnected platforms. The result is time spent reconciling and checking information that should be readily accessible.

There are financial implications too. Digital storage can appear inexpensive, making indefinite retention seem harmless. However, the cost extends beyond a cloud subscription, as it includes the infrastructure needed to store, back up, secure, migrate, manage, and retrieve information over time. As data volumes grow, so does the administrative cost burden.

It also affects newer technology. Systems and workflows powered by AI depend on the quality of the material they draw on, and large volumes of redundant or outdated information can make outputs slower and more difficult to validate. Strong information governance gives businesses a clearer view of what information they hold, where it came from, who owns it, how current it is and whether it can be relied on,providing a foundation for trusted AI, better reporting, and more informed business decision-making.

The environmental implications of storing what you do not need

The environmental consideration is the one most often overlooked, and for a business reporting on sustainability, it is the most awkward. Digital systems and data infrastructure require continuous energy to power and cool operations. When organisations maintain vast amounts of redundant data across digital architectures, that footprint incurs an ongoing operational energy requirement.

Retaining everything can therefore work against sustainability objectives.. Businesses may be working to reduce their environmental footprint while simultaneously accumulating growing volumes of redundant information that continues to consume resources behind the scenesInformation should thus be retained intentionally, for an identified purpose, and for an appropriate period.

The challenge extends beyond environmental impact. As businesses respond to increasing requests for sustainability information from customers, lenders, and insurers, information hoarding makes it harder to identify and substantiate critical data. Deloitte’s 2025 C-suite Sustainability Report found that data challenges were the second most-cited obstacle in preparing for and executing against sustainability reporting requirements, nominated by 40% of respondents. Two-thirds said tracking and analysing environmental metrics improved regulatory compliance and governance — the strongest positive result of any sustainability action surveyed. In this sense, sustainability reporting can be a catalyst for better information practices across the business. The goal is ultimately to build a reliable evidence base that supports decisions long after the reporting deadline has passed.

Retain what matters and understand why

The risk lies not in retaining information itself, but in retaining information indefinitely without knowing why it is held or when it should be reviewed, archived, or securely disposed of. The shift required is moving from unmanaged storage to managing information across its entire lifecycle—with clear governance at each stage around what is retained, digitised, archived, or securely disposed of.That means making deliberate decisions about what is kept, why it is needed, how long it must be retained, who is accountable for it, how it can be verified, and when it can be securely disposed of.

1. Know what you hold, where, and why. A simple inventory of systems, drives, mailboxes and physical storage is enough to begin. Businesses should identify a piece of information’s business purpose, owner, sensitivity, and whether it is the authoritative version. Most businesses are surprised by how much sits outside their main platforms.

2. Set retention periods that reflect real obligations and value.. Decide how long information needs to be kept against legal, tax and operational requirements.Retention schedules should also account for material needed to substantiate sustainability disclosures and other business claims.Material that falls outside them, and has no operational value, is a liability rather than an asset.

3. Prioritise auditable data. Businesses should be able to trace ESG information back to its original source, check how it has been recorded, and produce supporting documentation when customers, regulators or auditors require it. This provenance also makes information more useful for AI-enabled workflows and day-to-day business decisions. Reported metrics are only as credible as the records behind them.

4. Strengthen data governance. Governance should be embedded in the way information is collected and managed. In a small business that may be one named owner and a written retention schedule rather than a formal function. The objective is to ensure people can identify which information is reliable, current and fit for purpose.

Why Group 3 businesses should prepare now for 2027

Ungoverned information accumulation is easy to ignore because nothing visibly breaks. Storage keeps growing, subscriptions keep renewing, and the cost remains largely hidden until someone needs information the business cannot produce quickly.

Those requests are becoming more common. Customers increasingly need value chain data for their own climate and sustainability reporting, while lenders and insurers are asking related questions as they assess risk. Not every business will be contacted directly, and many will rely on industry averages. But when evidence is required, companies with reliable data will be far better positioned than those relying on estimates. Businesses that cannot substantiate their claims risk regulatory scrutiny, including potential enforcement action, and reputational damage with customers and stakeholders.

For Group 3 businesses, this is as much a commercial opportunity as a compliance challenge. Better information governance not only makes reporting easier, but it also reduces the cost and risk of maintaining redundant material, and creates a stronger foundation for customer engagement, risk management, AI adoption, and strategic decision-making.

As reporting obligations and ESG scrutiny increase, the businesses best placed to demonstrate progress will be those that understand what they hold, why they hold it, where it came from, and how it can be verified in order to make better decisions.