Build a Record Retention Schedule

Many small businesses keep documents for one of two reasons: they might need them again, or they are worried that deleting them could cause a problem.

The result is often an inconsistent filing system. Invoices are stored in several folders, old customer information remains in email accounts, contracts are difficult to locate and nobody knows which documents can safely be deleted.

Keeping every document forever is not a practical solution.

It increases storage requirements, makes information harder to find and can create unnecessary privacy and security risks. On the other hand, deleting important records too early can make it difficult to respond to tax queries, audits, disputes or company administration requirements.

South African businesses need a structured approach to deciding what to keep, why it must be retained, where it should be stored and when it can be disposed of.

A record retention schedule provides that structure.

It is particularly important to understand that there is no single retention period that applies to every business document. Different laws and business circumstances can impose different requirements.

Three important starting points are the South African Revenue Service's record-keeping requirements, section 24 of the Companies Act and section 14 of the Protection of Personal Information Act (POPIA).

What is a record retention schedule?

A record retention schedule is a document that explains how long different categories of business records should be kept and what should happen when the applicable retention period ends.

It normally identifies:

• The type of record.
• Why the business keeps it.
• Which legal or operational requirement applies.
• How long it must be retained.
• When the retention period begins.
• Who is responsible for the record.
• Where it is stored.
• Who may access it.
• How it should be securely disposed of.

The schedule turns record keeping from an informal habit into a managed business process.

It also helps employees understand that a document should not be deleted simply because it is old or difficult to organise.

1. Understand the SARS record-keeping period

The SARS record-keeping rules are an important starting point for businesses that submit tax returns.

SARS explains that taxpayers must keep records, books of account and supporting documents so that they can demonstrate compliance with tax requirements.

Its published guidance generally requires a person who has submitted a return to retain the relevant records for five years, counting from the date the return was submitted.

The exact treatment depends on the taxpayer's circumstances.

For example:

• A person who submitted a return generally retains the relevant records for five years from submission.
• A person required to submit a return but who has not done so may need to retain records indefinitely after the initial five-year period until the return is submitted.
• A person who was not required to submit a return but received income or engaged in taxable activity has separate retention considerations.
• Records connected to an audit or investigation must be retained until that process is concluded.
• Records connected to an objection or appeal may need to be retained until the disputed matter becomes final.

These distinctions are important. A business should not simply calculate five years from the date an invoice was issued and assume that the document can then be deleted.

The relevant trigger may be the date a return was submitted, the end of a tax period or the conclusion of an audit or dispute.

SARS also states that records must be kept in their original form, in an orderly fashion, in a safe place and available for inspection, audit or investigation.

Electronic records may be kept in the form prescribed by the Commissioner. SARS identifies circumstances in which taxpayers must request authorisation to keep records in a different form or at a physical location outside South Africa.

The current SARS record-keeping guidance was updated on 19 August 2026.

2. Understand the Companies Act seven-year requirement

Businesses operating through companies also need to consider section 24 of the Companies Act 71 of 2008.

Section 24(1) states that documents, accounts, books, writings, records or other information that a company is required to keep under the Act or another public regulation must be kept:

• In written form, or in another form that can be converted into written form within a reasonable time.
• For seven years, or for any longer period specified in another applicable public regulation.

Section 24 also identifies specific company records that must be maintained.

These include:

• The company's Memorandum of Incorporation and amendments.
• Records of current and past directors.
• Reports presented at annual general meetings.
• Annual financial statements.
• Accounting records.
• Notices and minutes of shareholders' meetings.
• Shareholder resolutions and related documents.
• Certain written communications to holders of securities.
• Minutes and resolutions of directors and relevant committees.

The Act also specifies that accounting records must be maintained for the current financial year and the previous seven completed financial years.

This is an important distinction.

The seven-year period is not simply a replacement for every other retention rule. It applies to company records required under the Act or another public regulation, and specific records have their own wording and retention requirements.

A sole proprietor is not automatically subject to every company-record requirement in section 24 simply because the business operates in South Africa. The business's legal structure matters.

You can consult the official Companies Act 71 of 2008, particularly section 24.

3. Understand POPIA's retention limitation

Record retention is not only about keeping information long enough.

Businesses must also consider when personal information should no longer be retained.

Section 14 of POPIA deals with the retention and restriction of records containing personal information.

It states that personal information should not be retained for longer than is necessary to achieve the purpose for which it was collected or subsequently processed, subject to specified exceptions.

These exceptions include circumstances where:

• Retention is required or authorised by law.
• The responsible party reasonably requires the record for lawful purposes related to its functions or activities.
• Retention is required by a contract.
• The data subject has consented to the retention.

Section 14 also addresses what happens when the business is no longer authorised to retain the information. The responsible party must destroy or delete the record, or de-identify it, as soon as reasonably practicable. Destruction or deletion must prevent reconstruction in an intelligible form.

This creates an important balance.

A business should not delete tax records merely because they contain personal information and a general retention period has passed if another law still requires the records to be retained.

Equally, it should not keep every customer enquiry, identification document or marketing contact indefinitely just because the business might find the information useful one day.

The business needs to understand both the legal retention obligation and the purpose for which personal information is being held.

Read POPIA section 14 in the official Act.

4. Why five years and seven years are not contradictory

A common record-keeping question is whether a South African business should retain documents for five years or seven years.

The answer depends on which requirement applies to the particular record.

SARS's guidance describes tax-related retention periods. The Companies Act imposes requirements on records that companies must keep under that Act or other public regulation.

A company may therefore have records that fall under both sets of requirements.

Where more than one legal requirement applies, the business must comply with all of them. In practice, this may mean retaining a particular record for the longer applicable period.

However, it would be inaccurate to say that every document belonging to every business must automatically be kept for seven years.

The business should identify the applicable law, record category and retention trigger before deciding when to dispose of it.

The following table is a planning aid, not a complete legal retention schedule:

Do not use this table as a reason to delete records without checking the underlying legal requirements.

5. Create categories for your business records

A retention schedule becomes easier to manage when records are grouped into understandable categories.

A small business might use the following structure:

Financial and tax records

• Sales invoices.
• Purchase invoices.
• Receipts.
• Bank statements.
• Payment confirmations.
• Tax returns.
• Tax assessments.
• SARS correspondence.
• VAT and payroll-related records where applicable.

Company and governance records

• Incorporation documents.
• Memorandum of Incorporation.
• Director records.
• Shareholder records.
• Meeting minutes.
• Resolutions.
• Annual financial statements.

Customer and supplier records

• Contracts.
• Service agreements.
• Purchase orders.
• Supplier information.
• Customer correspondence.
• Complaints and dispute records.

Employment records

• Employment agreements.
• Payroll information.
• Leave records.
• Disciplinary documentation.
• Training records.
• Relevant correspondence.

Operational records

• Policies and procedures.
• Standard operating procedures.
• Project records.
• Quality-control records.
• Asset registers.
• Insurance documentation.

Marketing and communication records

• Newsletter subscriber information.
• Marketing consent records.
• Campaign records.
• Customer communication preferences.
• Unsubscribe and objection records.

These categories are not all governed by the same retention period. The schedule should identify the requirements applicable to each one.

6. Build the retention schedule

Once the business has identified its record categories, create a schedule that can be used consistently.

A useful template includes the following fields:

A schedule should be understandable to the people who use it.

Avoid vague instructions such as "keep important documents permanently" or "delete old records after five years".

Instead, identify the document category and the applicable trigger.

For example, a tax record may need to be retained for a period calculated from the submission of a return rather than from the date on the document itself.

7. Organise electronic records properly

Electronic storage can make record management easier, but only when the information is organised and retrievable.

A folder containing thousands of files with names such as scan001.pdf, invoice-final-new.pdf and document-copy.pdf is not an effective records management system.

Use a consistent naming convention.

For example:

2026-10-31_supplier-name_invoice_001.pdf
2026-10-31_customer-name_service-agreement.pdf
2026-10-31_company_directors-resolution.pdf

The date should follow a consistent format, and the filename should identify the document without exposing unnecessary personal information.

Organise folders by category, financial year, project or another structure that reflects how the business retrieves information.

Consider:

• Restricting access to sensitive records.
• Maintaining secure backups.
• Keeping important documents in their original form.
• Using version control for policies and agreements.
• Avoiding uncontrolled copies across personal devices.
• Ensuring that records can be exported or reproduced when needed.
• Recording changes to important company documents.

SARS's requirements for orderly and safe record keeping are relevant when designing an electronic filing system.

Businesses should also understand where their electronic records are physically stored. SARS identifies records kept outside South Africa as a circumstance that may require authorisation under its record-retention process.

If a cloud provider is involved, establish where the records are stored and obtain appropriate tax or legal guidance on the applicable requirements.

8. Assign responsibility for each category

A retention schedule will not work if nobody is responsible for maintaining it.

A small business may not have a dedicated records manager. That does not prevent it from assigning responsibility.

For example:

• The owner or director may oversee company records.
• The bookkeeper may manage financial and tax documentation.
• An HR administrator may manage employment records.
• A designated employee may manage customer correspondence.
• A system administrator may manage storage permissions and backups.

These roles should be assigned according to the actual structure of the business.

Where an external accountant, payroll provider or document storage provider maintains records, the business should understand what is held, where it is held and how it can be retrieved.

Outsourcing record storage does not remove the need for the business to understand its obligations.

9. Create a secure disposal process

A retention schedule should explain what happens when a record reaches the end of its applicable retention period.

It should not rely on employees independently deciding which files look old enough to delete.

A controlled disposal process could include:

1. Identify records approaching their review date.
2. Check whether an audit, investigation, objection, appeal or dispute is still active.
3. Confirm that no other legal or contractual retention requirement applies.
4. Check whether personal information remains necessary for a lawful purpose.
5. Obtain approval from the person responsible for the record category.
6. Delete or destroy the records securely where authorised.
7. Record what was disposed of and when.

For physical records, secure shredding or an appropriate destruction service may be necessary.

For electronic records, deletion should consider active storage, synchronised copies and backups. The business should understand whether deleted records remain recoverable and how backup retention is managed.

POPIA section 14 requires destruction or deletion to be carried out in a manner that prevents reconstruction in an intelligible form.

Do not delete records that are subject to a legal hold, audit or active dispute simply because the normal retention date has arrived.

10. Review the schedule when the business changes

A retention schedule should be reviewed periodically.

It may need updating when:

• The business changes its legal structure.
• A new service or product is introduced.
• The business begins employing staff.
• The business registers for additional tax obligations.
• A new contract imposes record-keeping requirements.
• The business starts collecting additional personal information.
• A new system or cloud provider is introduced.
• A relevant law or regulation changes.

A small business that begins as a sole proprietorship may later become a company. Its record-keeping requirements may change as a result.

Similarly, a business that introduces customer accounts or online subscriptions may begin processing more personal information and need clearer retention and deletion procedures.

Review the schedule at least annually and whenever a significant operational or legal change occurs.

11. A practical example for a small business

Imagine a growing service business that operates from a small office and serves customers in areas such as Maboloka, Soshanguve and Centurion.

It receives enquiries through its website, sends quotations by email, issues invoices, buys materials from suppliers and keeps customer correspondence.

Without a retention schedule, documents may be scattered across:

• A bookkeeping application.
• Email inboxes.
• Shared cloud folders.
• Staff laptops.
• Mobile phones.
• Physical filing cabinets.

The business may also retain customer information long after the original purpose has ended.

A simple records management project would begin by identifying these locations and assigning each record category an owner.

The business could then map tax and company records to the applicable legal requirements, review personal information under POPIA and create a secure disposal process.

The result is not simply a cleaner filing system. It is a more reliable way to retrieve information, demonstrate compliance and reduce unnecessary exposure of personal information.

Business Documentation Support:

Mogen's Business Documentation service can be explored here: Business Documentation.

12. Record retention checklist

Use this checklist as a starting point for reviewing your current system:

• Identify the business's legal structure.
• List the categories of records the business creates and receives.
• Identify which records are required for tax purposes.
• Review Companies Act requirements where the business is a company.
• Identify personal information held by the business.
• Establish the purpose and applicable retention basis for personal information.
• Record the retention period and trigger date for each category.
• Assign a responsible person to each category.
• Document where electronic and physical records are stored.
• Review access permissions and backup arrangements.
• Create a secure disposal process.
• Check for audits, investigations, objections, appeals and disputes before disposal.
• Review the schedule annually and after significant changes.

Frequently asked questions

Must every South African business keep records for seven years?

No. Section 24 of the Companies Act applies to company records required under that Act or another public regulation. SARS has separate tax record-keeping requirements, generally involving five-year periods with important exceptions. The applicable period depends on the business and the record.

Does SARS allow electronic record keeping?

SARS permits electronic records in the form prescribed by the Commissioner. Its guidance also identifies circumstances where authorisation is required, including certain arrangements involving records physically stored outside South Africa.

Does POPIA mean I must delete customer records after five or seven years?

No. POPIA section 14 is based on the purpose and lawful basis for retaining personal information, subject to exceptions including retention required or authorised by law. It does not establish one universal five- or seven-year period for all personal information.

Can I delete records while an audit is underway?

You should not dispose of records that must be retained for an active audit or investigation. SARS states that records subject to an audit or investigation must be kept until that process is concluded.

Should a small business have a written retention policy?

A written policy and schedule make it easier to apply consistent decisions, assign responsibility and demonstrate how records are managed. The level of detail should be appropriate to the business's size, activities and obligations.

Published promotions:

Visit Mogen's promotions page to review currently published offers relevant to your business requirements.

Conclusion

Good record keeping is not about storing every document forever. It is about knowing which records the business needs, why they must be retained and when they can be disposed of.

South African businesses should distinguish between SARS tax requirements, the Companies Act requirements that apply to companies and POPIA's rules for retaining personal information.

A practical record retention schedule brings these requirements into one manageable system. It gives employees clear instructions, helps the business retrieve important information and reduces the risk of retaining personal information without a valid reason.

Start by identifying the records you already hold. Then establish the applicable requirements, assign responsibility and document a secure disposal process.

A consistent system is easier to maintain than a filing cabinet or cloud folder that nobody knows how to manage.

Sources

• SARS: Record Keeping
• Department of Justice: Companies Act 71 of 2008
• Department of Justice: Protection of Personal Information Act 4 of 2013