Council records and FOI workflows in South Australia: a practical digital design

Every South Australian council answers Freedom of Information (FOI) applications and keeps official records, and both jobs depend on the same thing: being able to find the right documents quickly, know which version is authoritative, and show what was done with them. When records are scattered across email, Teams chats, network drives and line-of-business systems, an FOI request turns into a hunt, deadlines slip and the risk of releasing the wrong thing rises. This guide explains the obligations that shape the workflow, where it usually breaks, and a practical digital design that councils of any size can adopt in stages. It is general guidance, not legal advice; confirm details with your governance team, State Records and your legal advisers.

The obligations that shape the workflow

Councils are “agencies” under both the State Records Act 1997 (SA) and the Freedom of Information Act 1991 (SA). In practice that means:

• Records must be managed, not just stored. State Records’ Information Management Standard is binding on agencies and expects an information governance program: policy, roles, an information asset register, security and privacy controls, a disposal program and self-assessment.
• Disposal follows the schedule. Local government records are sentenced against General Disposal Schedule 40 (GDS 40), which replaced GDS 20 in 2020. Destroying paper originals after digitisation is only permitted on the conditions State Records sets for that purpose, so scanning projects need those conditions designed in from the start.
• FOI applications have a clock. An application must be dealt with within 30 calendar days of receipt, or it is taken to be refused. The principal officer can extend the time for large requests or where third-party consultation is needed, but only by written notice to the applicant within 20 days of receipt, with reasons and review rights.
• Only an accredited FOI officer can determine. Other staff can clarify the request, search, collate and consult, but the determination itself must be made by an accredited FOI officer to be valid.
• Decisions can be reviewed. An applicant can seek internal review within 30 days, which the council must decide within 14 days, then external review by Ombudsman SA or the South Australian Civil and Administrative Tribunal (SACAT). Every step needs an evidence trail.
• Privacy and confidentiality still apply. Documents often contain residents’ personal information, commercial details from contractors and legal advice, so consultation and redaction are core steps, not afterthoughts.

Where council workflows usually break

• Records live outside the records system. Decisions made in email or Teams, attachments saved to personal drives and documents held only in a planning, asset or customer request system are hard to search and easy to miss.
• Search is manual and system by system. Officers ask colleagues to “check your inbox”, and nobody can show afterwards which locations were searched and with what terms.
• Deadlines are tracked in a spreadsheet. The 20-day extension window and the 30-day determination date are easy to miscount when an application is clarified, transferred or put on hold for fees.
• Redaction is visual only. Black boxes drawn over text in a PDF, or comments and tracked changes left in a Word file, can expose exactly what the council meant to withhold. Document properties and embedded metadata leak too.
• Duplicates inflate the work. The same email thread appears in ten mailboxes, and each copy is reviewed separately.
• Disposal never happens. Without sentencing at capture, records pile up past their retention period, which increases storage cost, breach exposure and the volume every future FOI search has to wade through.

A practical digital design

A workable design has five parts. Most councils already own some of them through Microsoft 365 or an existing electronic document and records management system (EDRMS).

1. Capture at the source. Map GDS 40 classes to retention labels or EDRMS classifications, apply them by default to team sites, libraries and record types, and integrate line-of-business systems so key documents (approvals, notices, contracts, correspondence) are captured with metadata rather than copied by hand. Our council customer request and field service architecture shows how requests and works records can flow into the record keeping system automatically.
2. An FOI case register with the statutory clock built in. Each application becomes a case with its receipt date, applicant details, scope, fee status, consultation steps and calculated dates for the extension notice, determination, and review windows. Reminders go to the accredited FOI officer and the principal officer before each date, and every action is logged.
3. Defensible search across systems. Use the content search or eDiscovery tools in your platform to search mailboxes, Teams, SharePoint and OneDrive with saved queries, and record which systems were searched, by whom and with what terms. De-duplicate results before review.
4. A review and redaction workspace. Reviewers tag each document (release, partial release, refuse, consult) against the exemption being considered, and a true redaction tool removes the underlying text and strips metadata before anything leaves the council. A second person checks the release package.
5. Release, register and learn. The determination, schedule of documents and release package are stored as records against the case. Simple reporting on volumes, timeliness and extensions helps the council meet its annual FOI reporting and spot recurring requests that could be met by proactive publication instead.

The secure Microsoft 365 workplace architecture shows how retention labels, sensitivity labels and access controls fit together in a council tenant. If records are also used to ground an AI assistant, the government knowledge assistant reference architecture covers classification-aware retrieval and FOI-ready logging.

Microsoft 365 or a dedicated EDRMS?

• Microsoft 365 records management keeps records where staff already work. Retention labels, records declaration and disposition review can enforce GDS 40 without asking staff to save documents twice. Some features need higher licence tiers, and file plan design matters far more than the product, so confirm current licensing before you budget.
• A dedicated EDRMS gives mature classification, physical file tracking and strong audit, and many SA councils already run one. The risk is a parallel world: if staff keep working in Outlook and Teams, the EDRMS holds only what people remember to file. Integration with Microsoft 365 and line-of-business systems is what makes it complete.
• Either way, decide which system is the authoritative copy for each record type, keep that decision in the information asset register, and make sure backups and recovery cover it (see our guide to backup and disaster recovery for SA Government ICT).

Where automation and AI help, and where they must not decide

Automation earns its place in the repetitive parts: calculating dates and sending reminders, running saved searches, removing duplicates, suggesting record classifications at capture, and flagging likely personal information, signatures or contractor pricing for a reviewer to check. Generative AI can draft a first-pass schedule of documents or summarise a long email thread for the reviewer.

It must not make the determination. The FOI Act requires an accredited FOI officer to decide, exemptions involve judgement about public interest and harm, and an AI model can miss context or invent detail. Keep a person accountable for every release decision, log what any tool suggested, and treat AI tools that touch records as part of your AI inventory under your responsible AI approach. Our guide to AI for South Australian councils lists other low-risk starting points.

Security and privacy controls

• Least privilege for the FOI team. FOI officers often need wide search rights. Grant them through a dedicated, audited role used only for FOI work, not by making officers site owners everywhere.
• Protect the case files. FOI cases contain applicants’ identities and sensitive documents. Restrict access to the case team and log every view and export.
• Keep data onshore and confirm where every component, including search indexes and any AI features, stores and processes data (see Australian data residency for SA Government ICT).
• Plan for mistakes. An accidental release of personal information is a privacy incident. Have the response steps ready; our guide to privacy and data breach response for SA organisations explains how to assess and respond.

A practical first 90 days

1. Weeks 1 to 3: discover. Map where records actually live, review the last year of FOI applications for volumes, timeliness and pain points, and check how GDS 40 classes are applied today.
2. Weeks 4 to 8: build the backbone. Stand up the FOI case register with the statutory dates and reminders, define saved searches across the main systems, and configure true redaction with metadata removal. Pilot on new applications.
3. Weeks 9 to 12: capture and dispose. Apply default retention to the busiest team sites and libraries, connect one line-of-business system to the records system, and run the first disposal review of records already past their retention period.

Questions to ask before you engage anyone

1. How will GDS 40 be applied by default at capture, rather than by staff choosing a class every time?
2. How does the FOI register calculate and track the 20-day extension notice and the 30-day determination date?
3. Can we show, for any application, which systems were searched, by whom and with what terms?
4. How is redaction verified, and how is document metadata removed before release?
5. Which system holds the authoritative copy of each record type, and how is it backed up and recovered?
6. Where is every component hosted, including search indexes and any AI features?
7. Will our records and governance team be able to maintain the configuration without you?

This article reflects the legislation and State Records guidance as at late 2026. Requirements, schedules and product features change, so confirm current details with State Records of South Australia, Ombudsman SA guidance and your legal advisers before you change your processes.

Talk to an Adelaide team

If your council wants FOI and records work that is faster and easier to evidence, talk to us about a records and FOI workflow review or call 0402 401 584. We can start with a short, fixed-price discovery that maps where records live and produces a costed plan you can use with any supplier. You can also read about our intelligent automation, application development and managed services.