A small business can accumulate a surprising amount of paperwork and digital information. Invoices, receipts, contracts, customer enquiries, employee records, tax documents and supplier agreements may be spread across email accounts, filing cabinets, personal computers and cloud storage.
When these records are organised, they help a business explain transactions, resolve disputes, prepare reports and make better decisions. When they are scattered or retained without a clear purpose, they become harder to find and more difficult to protect.
South African businesses also need to distinguish between records that must be retained for legal or regulatory reasons and information that is useful only for a limited operational period.
The South African Revenue Service (SARS) states that many tax records must be retained for five years, subject to different rules for particular circumstances. The Protection of Personal Information Act (POPIA) also places limits on how long personal information should be retained, subject to the exceptions set out in the Act.
This means a sound records policy is not simply a rule that says "keep everything for five years". It should explain what the business holds, why it holds it, how long it needs to keep it, who can access it and how it will dispose of it appropriately.
This guide outlines a practical approach for small and growing businesses.
It provides general administrative information rather than legal or tax advice. Specific retention requirements can differ by record type, business structure and circumstances.
What is business record retention?
Record retention is the process of keeping records for an appropriate period and disposing of them when they are no longer required or authorised to be retained.
It is closely related to document management, but the two are not identical.
Document management covers how records are created, named, stored, retrieved, shared and maintained. Retention management adds rules for how long different records should remain available and what should happen when the applicable period ends.
A business record might be a paper invoice, an electronic receipt, a signed contract, an email approving a transaction or a digital report exported from an accounting system.
The medium does not remove the need to manage the record. Digital documents need suitable access controls and backups, while physical records need organised, secure storage.
1. Start by identifying the records you have
Before deciding how long to keep documents, make an inventory of the records the business actually creates and receives.
Do not start by buying a document management system. Begin with a practical list of the places where information is stored.
These might include:
- Accounting and bookkeeping software.
- Bank statements and payment records.
- Email accounts.
- Contracts and signed agreements.
- Employee and payroll files.
- Customer records and enquiries.
- Supplier documents.
- Company administration records.
- Project files and business correspondence.
- Shared drives, cloud folders and physical filing cabinets.
Ask the people responsible for each area how they currently create, name and store documents.
You may discover that the same invoice exists in several locations, that important agreements are held in one employee's mailbox or that a former staff member's files cannot easily be accessed.
These findings help identify the risks before a new policy is introduced.
2. Understand SARS record-keeping requirements
Tax records are a sensible starting point because they support the information submitted in tax returns and may be needed if SARS requests supporting documentation.
SARS's record-keeping guidance explains which taxpayers must retain records and the applicable periods.
For many taxpayers who have submitted a return, SARS describes a five-year retention period counted from the date the return is submitted. The page also identifies situations where the period differs, including outstanding returns, objections or appeals, and audits or investigations.
The exact rule depends on the circumstances. Do not apply a single five-year rule to every document without checking whether another requirement or an ongoing matter affects the period.
Common financial records include:
- Sales invoices and receipts.
- Purchase invoices and expense receipts.
- Bank statements and deposit records.
- Accounting ledgers and journals.
- Records supporting income and deductions.
- Tax returns and relevant supporting documents.
- VAT records where applicable.
- Payroll and employees' tax records where applicable.
Keep records in an orderly and safe manner so they can be located and made available when required.
SARS permits certain records to be kept electronically in accordance with the applicable requirements. However, if a business intends to keep records in a different form from that required, or store electronic records outside South Africa, it should review SARS's guidance on whether authorisation is necessary.
Consult the relevant SARS record-retention authorisation guidance before making assumptions about where or how records may be stored.
3. Do not confuse tax retention with every other retention rule
A business may need to retain a tax record for a prescribed period while also managing other obligations relating to the same document.
A signed contract, for example, may support a tax transaction but also be relevant to a continuing contractual relationship or a dispute. The business should not automatically destroy it merely because one general retention period has passed.
Similarly, some documents may contain personal information that should not be retained indefinitely without an appropriate reason.
A good retention schedule records the relevant requirements for each category rather than relying on one blanket date.
If a document relates to an audit, investigation, objection, appeal, litigation or other unresolved matter, suspend routine destruction where the record must be preserved. Seek appropriate professional guidance if you are uncertain about the applicable obligation.
4. Account for POPIA when retaining personal information
Business records may contain personal information about customers, employees, suppliers or other identifiable people.
POPIA's section 14 addresses the retention and restriction of records. In general, records of personal information must not be retained longer than necessary to achieve the purpose for which they were collected or subsequently processed, unless an exception in the Act applies.
The Act includes exceptions relating to legal requirements, lawful business purposes, contractual requirements and consent, subject to the applicable conditions.
It also provides for the destruction, deletion or de-identification of records when retention is no longer authorised.
Read section 14 of the Protection of Personal Information Act 4 of 2013 and consider the circumstances in which your business processes personal information.
This is particularly relevant to records such as:
- Customer contact details.
- Copies of identity documents.
- Employee information.
- Recruitment records.
- Customer enquiries.
- Marketing databases.
- Support correspondence.
- Information collected through website forms.
Do not keep personal information merely because storage is inexpensive or because the business might possibly find it useful one day.
Equally, do not destroy information that must lawfully be retained or that is needed for an applicable legal purpose. The policy should distinguish the purpose of the record, the applicable retention basis and any relevant exceptions.
5. Create a records retention schedule
A retention schedule is a practical document that identifies categories of records and explains what should happen to them over time.
It helps staff apply consistent rules rather than deciding individually whether to keep or delete each file.
A useful schedule can include the following fields:
| Field | What to document |
|---|---|
| Record category | The type of record, such as sales invoices |
| Purpose | Why the business needs the record |
| Owner | The person or role responsible for the category |
| Storage location | The approved system or physical filing location |
| Access controls | Who may view or change the record |
| Retention trigger | The event or date from which the period is calculated |
| Retention period | The applicable period and its basis |
| Exceptions | Audits, disputes or other reasons to preserve the record |
| Disposal method | Secure deletion, destruction or de-identification |
| Review date | When the policy or category should next be checked |
The schedule does not need to be complicated. A spreadsheet can be sufficient for a small business if it is maintained, access is controlled and the information is clear.
The important part is making the rules understandable and consistently applied.
6. Separate business records by purpose
Avoid placing every document into one large folder called "Business Documents".
A more useful structure separates records by a logical business function.
For example:
- Finance and accounting.
- Tax submissions and supporting records.
- Contracts and agreements.
- Employees and payroll.
- Customers and suppliers.
- Projects and operational records.
- Governance and company administration.
Within each category, use consistent filenames and folder structures.
A file name might include a document type, date, counterparty or project reference. Avoid putting unnecessary personal information into filenames where the name itself could be exposed in a shared folder or email attachment.
Use the same conventions across the team. A naming system is only useful if people understand it and follow it.
7. Manage digital records safely
Electronic storage can make documents easier to search, back up and share, but it also introduces security and continuity risks.
Start by choosing approved storage locations. Important business records should not exist only on one employee's personal computer or in an email account that nobody else can access.
Consider these controls:
- Use strong, unique passwords and multi-factor authentication where available.
- Restrict access according to job responsibilities.
- Remove access when staff leave or change roles.
- Keep backups of important records.
- Test whether records can actually be restored.
- Protect sensitive files when sharing them externally.
- Review the security and terms of external storage providers.
- Keep an inventory of the systems holding important records.
Backups and retention are related but different. A backup helps recover information after loss or damage; a retention schedule determines how long records should be preserved.
If a record must be destroyed, the business should consider the copies and backups in which it remains. The appropriate process depends on the storage system and applicable requirements.
8. Make records easy to retrieve
Keeping a document is not enough if nobody can find it when needed.
Retrieval should be tested using realistic tasks, such as finding a particular invoice, locating the agreement for a supplier or retrieving the supporting documents for a tax return.
A consistent index can help. It might record the document date, category, reference number, responsible person and storage location.
Avoid building a complex system that requires extensive manual data entry if the business cannot maintain it. A simple structure used consistently is often more useful than a sophisticated system that staff bypass.
For growing businesses, document management software may become worthwhile when search, access control, approval workflows or record volumes become difficult to manage manually.
Before adopting a new platform, identify the problem it needs to solve and how existing records will be migrated, secured and retained.
9. Establish a secure disposal process
A retention policy should explain what happens when the applicable period ends.
For paper documents, this may involve secure shredding or another appropriate destruction process. For digital records, it may involve deletion through the approved storage system and consideration of relevant copies or backups.
The method should suit the sensitivity of the information and the storage medium.
Do not destroy records simply because they have become old. First check whether the retention period has expired, whether a legal or operational exception applies and whether any unresolved matter requires preservation.
For personal information, POPIA section 14 includes requirements concerning destruction or deletion when retention is no longer authorised. The method should prevent the information from being reconstructed in an intelligible form where the Act requires this.
Keep a disposal log where useful. It can record the category of records, the period reviewed, the date of disposal, the method used and the person who approved the action.
The log itself should avoid reproducing unnecessary personal information from the destroyed records.
10. Assign responsibility and review the policy
A retention schedule will not remain accurate without an owner.
Assign responsibility for maintaining the schedule and reviewing changes in business operations, legal requirements and storage systems.
The owner does not need to handle every document personally. Different teams may manage their own records, while one designated role maintains the overall policy and ensures that exceptions are escalated.
Review the schedule when:
- The business introduces a new service.
- A new accounting or document system is adopted.
- Staff responsibilities change.
- A legal or regulatory requirement changes.
- An audit, dispute or investigation arises.
- A storage provider or data-processing arrangement changes.
- The business discovers that records are being retained unnecessarily.
For a small business, a periodic review may be enough to identify obsolete folders, duplicated records and unclear responsibilities. The appropriate interval depends on the complexity and risk of the business.
11. A practical implementation plan
You do not need to overhaul every file on the first day.
Use a staged approach:
Step 1: Inventory. Identify the main categories of records and where they are stored.
Step 2: Prioritise. Begin with tax, financial, contractual, employee and personal-information records that have clear retention or security implications.
Step 3: Verify requirements. Consult the applicable SARS guidance, legislation and professional advisers where necessary.
Step 4: Draft the schedule. Record the purpose, owner, storage location, retention trigger, period, exceptions and disposal method for each category.
Step 5: Standardise storage. Establish consistent folders, naming rules and access controls.
Step 6: Communicate the policy. Explain to staff where records belong and how to handle requests, exceptions and disposal.
Step 7: Review and improve. Test retrieval, confirm backups and refine the policy when the business changes.
Business documentation: Visit Mogen's Business Documentation section to explore the available services and discuss your business documentation requirements.
Frequently asked questions
Must every business record be kept for five years?
No. SARS identifies five-year periods for many tax records, but the applicable rule and starting point depend on the circumstances. Other legal, contractual, operational and privacy considerations may also affect retention.
Can I keep all my records digitally?
Electronic record keeping may be permitted, but the format and storage arrangements must meet the applicable requirements. Review SARS guidance before changing the required form or storing electronic records outside South Africa.
Does POPIA mean I must delete every old customer record?
No. POPIA's retention rules must be read with the exceptions in the Act and any other applicable legal obligations. The business should document why information is retained and dispose of it when retention is no longer authorised.
Is a spreadsheet sufficient for a retention schedule?
It can be suitable for a small business if it is clear, maintained and securely managed. Larger or more complex organisations may need a more structured records management system.
Conclusion
Business record retention is about keeping the right information for the right reasons, protecting it while it is needed and disposing of it appropriately when the applicable period ends.
Start with a clear inventory, distinguish tax requirements from other obligations, account for POPIA when personal information is involved and document the rules in a retention schedule.
A practical, consistently maintained system makes records easier to find, supports business administration and reduces the risks associated with keeping information without a clear purpose.
Current promotions: Review Mogen's promotions page for published offers that may be relevant to your website or digital business requirements.