Small businesses accumulate records every day: quotations, invoices, contracts, customer enquiries, employee information, supplier documents, emails and operational files.
Keeping records organised helps a business find information when it needs it. Keeping everything forever, however, can create unnecessary storage, security and privacy risks. Deleting records too early can be equally problematic when the information is needed for tax, contractual, regulatory or other legitimate purposes.
A records retention schedule provides a practical way to manage this balance.
For a growing South African business, the objective is to identify which records exist, why they are kept, how long they need to be retained, who can access them and how they should be disposed of when retention is no longer justified.
This guide explains how to establish a manageable system. It provides general operational information, not legal or tax advice.
1. Understand what a retention schedule does
A records retention schedule is a documented set of rules for managing records throughout their lifecycle.
It usually identifies:
- The category of record.
- The purpose for keeping it.
- The person or role responsible for it.
- The applicable retention rule.
- The event that starts the retention period.
- The approved storage location.
- Access and protection requirements.
- The method of disposal.
- Any conditions that suspend disposal.
This is different from a simple folder structure. A folder structure helps people locate records; a retention schedule explains how the records should be managed over time.
The schedule also prevents staff from making inconsistent decisions. One person should not delete an old invoice because it appears unnecessary while another keeps unrelated customer information indefinitely simply because storage space is available.
2. Identify the records your business actually holds
Start with an inventory of the records created, received and stored during normal business operations.
Common categories include:
| Category | Examples | Why the records may matter |
|---|---|---|
| Tax and finance | Invoices, receipts, accounting records, supporting documents | Tax obligations, financial reporting and audit trails |
| Contracts and agreements | Signed contracts, variations, termination records | Evidence of agreed terms and obligations |
| Customers | Quotations, orders, service records and correspondence | Service delivery, disputes and customer relationships |
| Suppliers | Purchase orders, invoices and supplier agreements | Payments, procurement and contractual obligations |
| Employees and contractors | Employment records, agreements and relevant correspondence | Employment administration and applicable obligations |
| Operations | Procedures, registers, maintenance records and approvals | Consistent work and accountability |
| Marketing | Enquiry forms, mailing lists and campaign records | Managing communications and applicable privacy obligations |
| Technology | Access logs, backups, system records and security incidents | Continuity, troubleshooting and security |
| Governance | Policies, decisions, approvals and formal business records | Accountability and evidence of decisions |
The table is a starting point, not a complete legal classification. The records required and their retention periods depend on the nature of the business and the laws, contracts and circumstances that apply.
Include electronic records as well as paper files. Relevant information may exist in email accounts, cloud storage, accounting platforms, messaging systems, shared drives and backup services.
Do not collect extra copies of sensitive information simply to complete the inventory. Record the location and category of existing material without unnecessarily duplicating it.
3. Identify the reason each category is retained
Before choosing a retention period, establish why the business needs the record.
Possible reasons include:
- Meeting a legal or regulatory obligation.
- Supporting a tax return or financial record.
- Fulfilling a contractual requirement.
- Managing an ongoing customer relationship.
- Demonstrating how a decision was made.
- Responding to an audit, investigation or dispute.
- Protecting the business's legitimate interests where retention is lawful and justified.
Different reasons can produce different retention requirements.
A document required for a tax audit should not automatically be deleted according to the same schedule as an outdated marketing draft. Equally, a customer's personal information should not be kept indefinitely just because the business might find it useful one day.
Record the reason for retention in plain language. If nobody can explain why a category is kept, investigate before deciding to retain or dispose of it.
4. Check applicable legal and contractual requirements
Retention periods should be based on the rules that apply to the particular record, not on a single number used for every document.
For example, the South African Revenue Service's record-keeping guidance explains that records required under the Tax Administration Act generally need to be retained for five years from the submission of the relevant return in the circumstances described by SARS. Additional conditions can extend retention, including certain cases where a return has not been submitted or an audit or investigation is ongoing.
That does not mean every document in every business must automatically be kept for five years. Other legal requirements, contractual obligations and the nature of the record can affect the applicable period.
A business should check the rules relevant to its tax status, industry and record types.
For personal information, the Protection of Personal Information Act (POPIA) also matters. Section 14 establishes a general principle that personal information should not be retained longer than necessary for the purpose for which it was collected or subsequently processed, subject to specified exceptions.
The Information Regulator's privacy notice describes retention, secure disposal and circumstances in which information may need to be retained for longer, including legal or contractual reasons.
These requirements need to be considered together. A business should not delete records that it is legally required to keep merely because a customer relationship has ended. It should also avoid retaining personal information without an appropriate justification once the relevant purpose and lawful retention grounds have ended.
If the requirements are unclear or conflicting, seek advice from an appropriately qualified professional before setting a final rule.
5. Define when the retention period begins
A retention period is only useful when staff know how to calculate it.
The starting event may be:
- The date a tax return is submitted.
- The end of a financial or reporting period.
- The date a contract terminates.
- The completion of a transaction.
- The end of an employment relationship.
- The date a case or matter is formally closed.
- The date a record is superseded.
The appropriate trigger depends on the rule that applies to the record.
Avoid vague instructions such as "keep for five years" when staff cannot tell which event starts the five-year period.
For example, if a retention requirement is measured from submission of a tax return, using the invoice date as the starting point could produce an incorrect disposal date.
Where the retention rule depends on several conditions, document the calculation method and identify the person responsible for confirming the disposal date.
6. Build a practical retention register
A small business can begin with a spreadsheet or another controlled register. It does not necessarily need specialised records-management software.
The register might contain:
| Field | Example of what to record |
|---|---|
| Record category | Tax supporting documents |
| Business purpose | Support submitted tax information |
| Applicable rule | Relevant SARS requirement |
| Retention trigger | Submission of the relevant return, where applicable |
| Retention period | Period confirmed for that record category |
| Record owner | Finance or administration role |
| Storage location | Approved accounting archive |
| Access restrictions | Authorised staff only |
| Disposal method | Approved secure deletion or destruction |
| Review status | Current, under review or suspended |
| Notes | Audit, investigation or other hold conditions |
Do not use the example categories or periods as a substitute for checking the actual rules.
Keep the register itself controlled. It should identify where records are stored without exposing unnecessary personal information or credentials.
Assign a named person or role to maintain the schedule. If the business is very small, the owner may perform that role, but the responsibility should still be explicit.
7. Separate routine disposal from a legal or business hold
A record may reach its normal disposal date while still being needed for a specific reason.
Examples include:
- An active tax audit or investigation.
- A dispute or legal proceeding.
- A contract that requires the record to be preserved.
- An unresolved customer claim.
- An instruction from an authorised professional or authority.
- A legitimate investigation into a security incident.
Establish a hold procedure that suspends ordinary disposal when an authorised person identifies a valid reason.
The hold record should specify which categories are affected, who authorised it, the reason and when it should be reviewed.
Do not continue a hold indefinitely without review. Once the reason ends and no other retention requirement applies, the record should return to the normal retention process.
If the business receives a notice concerning an audit, investigation or legal matter, do not delete potentially relevant records while the situation is being assessed.
8. Protect records while they are being retained
Retaining a document does not mean that everyone in the business should be able to access it.
Apply safeguards appropriate to the sensitivity of the records.
For electronic records, consider:
- Individual user accounts.
- Appropriate access permissions.
- Strong authentication.
- Encryption where suitable.
- Protected backups.
- Secure sharing methods.
- Monitoring of important access or changes.
- Timely removal of access when responsibilities change.
For paper records, consider:
- Locked storage for confidential material.
- Controlled access to filing areas.
- Secure transport of documents.
- Safe handling of printouts.
- Procedures for collecting and storing records away from public areas.
POPIA requires responsible parties to take appropriate, reasonable technical and organisational measures to protect personal information against risks such as loss, damage and unauthorised access.
The Information Regulator's Personal Privacy Principles provide practical guidance on collecting necessary information, maintaining accuracy and protecting records.
Businesses serving customers in Maboloka, Soshanguve, Centurion and elsewhere should apply the same basic principles regardless of whether records are kept in a physical office, on a local computer or in a cloud service.
9. Plan for email, messaging and cloud storage
Important records do not always arrive as formal documents.
A customer may approve a quotation by email. A supplier may confirm a change through a business messaging account. A contract variation may be recorded in a project platform.
Decide which communications must be preserved as business records and how they should be transferred into an approved storage location.
Avoid relying on one employee's personal inbox or phone as the only source of an important business record.
Where cloud services are used, confirm:
- Who administers the account.
- Which records are stored there.
- Where the provider physically stores electronic tax records.
- Whether SARS authorisation is required if records are stored outside South Africa.
- Whether the service supports export or retrieval.
- How backups and deleted items are handled.
- What happens when an employee or supplier leaves.
- How records are disposed of when the retention period ends.
Deleting a file from one folder may not remove copies in email archives, synchronised devices, shared locations or backup systems.
For personal information, consider how the business and its service providers will manage retention and disposal across the systems involved. Do not assume that a cloud provider's default deletion process automatically satisfies every applicable requirement.
10. Decide how records will be disposed of securely
When a record is no longer required and no retention obligation or hold applies, use a disposal method appropriate to its format and sensitivity.
Paper records: Confidential documents may need secure shredding or an approved destruction service. Ordinary recycling is not appropriate for records that could expose personal, financial or confidential business information.
Electronic files: Use the system's approved deletion process and consider whether copies exist in shared folders, devices, email archives or backups.
Portable devices: Before disposing of or transferring computers, storage devices and removable media, ensure that information is handled using an appropriate secure-erasure or destruction process.
Third-party services: Confirm how service providers handle retained copies and backups, and document any limitations or timelines that affect disposal.
The method should reflect the risk. An outdated public brochure does not require the same treatment as a file containing identity documents, financial information or employee records.
Keep a disposal log for categories where evidence of destruction is important. It may record the category, disposal date, method, responsible person and approval.
Avoid placing unnecessary copies of sensitive information in the disposal log itself.
11. Review the schedule when the business changes
A retention schedule should be reviewed when relevant laws, contracts, systems or business activities change.
Triggers may include:
- Introducing a new service.
- Starting to collect a new type of personal information.
- Changing accounting or payroll software.
- Moving records to a new cloud provider.
- Changing the company's legal or tax circumstances.
- Entering a new regulated activity.
- Discovering that records are being kept longer than intended.
- Identifying a new audit, dispute or investigation requirement.
A periodic review can also identify categories that have no owner, unclear retention triggers or unsuitable storage arrangements.
Keep the review proportionate to the size and risk of the business. A small business may begin with a simple annual review and additional checks when significant changes occur.
The important point is that the schedule remains aligned with actual business practices and applicable requirements.
CTA — Business Documentation
If your business needs a written records procedure, retention register or supporting template, explore Mogen's Business Documentation service to discuss the document requirements and scope.
12. A simple implementation plan
You can introduce a retention schedule in manageable stages.
Week 1: Inventory
List the major categories of paper and electronic records, their storage locations and the people responsible for them.
Week 2: Confirm the rules
Identify the legal, tax, contractual and operational requirements that apply to each category. Verify retention periods with official guidance or qualified advisers where needed.
Week 3: Draft the schedule
Record the retention trigger, period, owner, access requirements and disposal method. Identify categories that need specialist review before a rule is approved.
Week 4: Approve and implement
Approve the schedule, communicate responsibilities, identify existing records that require review and establish a process for holds and disposal.
This is an illustrative implementation timetable, not a statutory deadline. A business with extensive or sensitive records may need a longer project and specialist support.
Frequently asked questions
Must every business record be kept for five years?
No. SARS specifies retention requirements for relevant tax records, with conditions and exceptions. Other records may be governed by different legal, contractual, operational or privacy considerations. Confirm the applicable rule for each category.
Can a business delete customer information when the customer relationship ends?
Not automatically. The business should consider the purpose for which the information was collected, any applicable legal or contractual retention requirements, and other lawful grounds for retention. Dispose of information securely when retention is no longer justified.
Should the business keep records only on paper?
Not necessarily. SARS permits electronic record keeping in circumstances described in its guidance, subject to applicable requirements. Confirm the rules for your particular records and ensure that the records remain accessible and properly preserved.
Is a spreadsheet sufficient for a retention schedule?
It can be a practical starting point for a small business with a manageable number of record categories. More complex environments may need dedicated systems, formal approval workflows or specialist advice.
CTA — Discuss your documentation requirements
If you need help structuring a business procedure, register or document template, contact Mogen to discuss the intended use and scope of the work.
Conclusion
A records retention schedule helps a business preserve information it genuinely needs while avoiding uncontrolled accumulation of records.
Start by identifying what you hold, why you keep it and which requirements apply. Then document retention triggers, access controls, holds, secure disposal methods and review responsibilities.
For growing businesses in Maboloka, Soshanguve, Centurion and across South Africa, a manageable records process can improve organisation and reduce avoidable operational risk.
The schedule should reflect the business's actual circumstances. Confirm legal, tax, contractual and privacy requirements before approving retention periods or deleting records.