Many small businesses keep documents because they might be needed one day. Others delete old files when storage becomes difficult to manage. Both approaches can create problems.
Keeping records for too short a period can leave a business unable to support a tax return, explain a transaction or respond to an investigation. Keeping every document indefinitely can increase storage costs, make information harder to find and expose personal information to unnecessary risk.
South African businesses need a more deliberate approach: identify the types of records they hold, understand the requirements that apply, assign retention periods and make sure documents can be retrieved securely when needed.
Two important rules illustrate why a single retention period is not enough. The South African Revenue Service (SARS) generally requires relevant tax records to be kept for five years under the applicable conditions, while section 24 of the Companies Act establishes a seven-year period for specified company records. The Protection of Personal Information Act (POPIA) also limits how long personal information should be retained, subject to its exceptions.
These requirements serve different purposes. They should not be reduced to a blanket instruction to keep everything for five years—or to keep every document forever.
This guide provides a practical starting point for small and growing businesses. It is general information, not legal or tax advice for a particular organisation.
1. Understand what counts as a business record
A business record is not limited to a paper file in a cabinet.
Depending on the organisation, records may include:
- Quotations, invoices and receipts.
- Bank statements and accounting records.
- Supplier agreements and customer contracts.
- Purchase orders and proof of delivery.
- Payroll and employment records.
- Tax returns and supporting calculations.
- Company resolutions and governance documents.
- Correspondence about important transactions.
- Customer information and consent records.
- Digital files, exported reports and relevant system records.
The correct retention period depends on what the record contains, why it exists, which laws or contractual obligations apply and whether a dispute or investigation is ongoing.
A business should therefore classify records before deciding when they can be destroyed.
2. Why the SARS five-year rule is not the whole answer
SARS's record-keeping guidance explains that taxpayers must retain relevant records, books of account and documents for the periods applicable to their circumstances.
In general, a person who has submitted a tax return must retain the relevant records for five years, counted from the date of submission of the return until the last day of that period. Other circumstances have different starting points or extended requirements.
The guidance also addresses cases where a person has not submitted a required return, where an objection or appeal has been lodged, or where the person knows that records are subject to an audit or investigation.
In those situations, the ordinary five-year rule may not be sufficient.
The records should be organised, kept safely and remain available for inspection, audit or investigation. SARS also explains that electronic record keeping is subject to applicable requirements.
What should a small business do?
Do not set every folder to automatic deletion five years after its creation date.
The retention clock may start from a return's submission date, the end of a tax period or another event specified by the applicable rule. The business should record the relevant trigger and preserve documents for as long as an applicable extension requires.
A tax practitioner or accountant can help identify the correct periods for the business's specific records and tax circumstances.
3. Understand the Companies Act seven-year rule
Section 24 of the Companies Act 71 of 2008 deals with the form and standards of company records.
It states that documents, accounts, books, writing, records or other information that a company is required to keep under the Act or another public regulation must be retained for seven years, or for a longer period where another applicable public regulation requires it. The section also provides for a shorter period where a company has existed for less than seven years.
Section 24 specifies additional record-keeping obligations. These include categories of governance records, directors' records, annual financial statements and accounting records, as well as meeting minutes and resolutions.
The practical lesson is that a company should not assume that complying with a general tax-retention period automatically satisfies every company-record obligation.
The five-year tax rule and seven-year company-record rule address different legal requirements. A document may fall within more than one category.
Does every document have to be kept for seven years?
Not necessarily. Section 24 applies to records that a company is required to keep under the Act or another public regulation, and specific record categories have their own wording and requirements.
A business should classify records according to their actual purpose and obligations rather than applying the seven-year rule indiscriminately to every scrap of paper or duplicate file.
If a document supports a company record, tax position, contractual obligation or active dispute, consider all applicable requirements before authorising its destruction.
4. Apply POPIA's retention principle to personal information
Tax and company records are not the only consideration. Business documents often contain personal information, such as names, telephone numbers, identity details, employment information or customer correspondence.
Section 14 of the Protection of Personal Information Act 4 of 2013 provides that records of personal information should not be retained longer than necessary to achieve the purpose for which they were collected or subsequently processed, subject to specified exceptions.
Those exceptions include circumstances where retention is required or authorised by law, where the responsible party reasonably requires the record for lawful purposes related to its activities, where a contract requires retention, or where the relevant consent applies.
Section 14 also provides for destruction, deletion or de-identification when the responsible party is no longer authorised to retain the information, subject to the Act's provisions.
This creates an important distinction: a business may need to retain a financial or company record for a statutory period, but that does not mean it should keep every unrelated personal detail indefinitely.
How should the rules work together?
Start by identifying the purpose of the record and all applicable retention requirements.
If a law requires a record to be retained for a defined period, document that legal basis. If the record is needed for a legitimate, lawful purpose, document the reason and review whether the information remains necessary. If no retention basis remains, follow an appropriate deletion or de-identification process.
Where a record is subject to an audit, dispute, investigation or legal hold, suspend routine destruction until the responsible adviser confirms that it is appropriate to proceed.
Do not treat POPIA as a reason to destroy records that another law requires you to retain. Equally, do not use a tax or company-record obligation as a justification for keeping unrelated personal information without a valid basis.
5. Create a document-retention schedule
A retention schedule turns legal and operational requirements into a repeatable process.
It should identify each record category, its purpose, the applicable retention basis, the event that starts the retention period, the person responsible and the approved disposal method.
A starting template might look like this:
| Record category | What to establish | Practical control |
|---|---|---|
| Tax and accounting records | Applicable SARS period, starting event and any extensions | Keep organised supporting documents and prevent deletion during an audit or dispute. |
| Company records | Which records are required under the Companies Act or other applicable rules | Maintain governance records separately from routine working files. |
| Contracts | Contractual terms, legal obligations and any dispute-related requirements | Record the contract's end date and the basis for retention after expiry. |
| Customer information | Original purpose, applicable legal obligations and continuing need | Restrict access and review whether information remains necessary. |
| Employee records | Applicable employment, tax and other legal requirements | Confirm category-specific periods with an appropriate adviser. |
| Correspondence | Whether the message evidences a transaction, instruction, decision or legal obligation | File important correspondence with the relevant matter rather than retaining every message indefinitely. |
This table is a framework, not a declaration that every record in a category has the same legal retention period.
The business should have a written schedule that can be reviewed when laws, operations or contractual arrangements change.
6. Organise records so they can be retrieved
A retention policy is less useful if staff cannot find the relevant documents when required.
Choose a folder structure that reflects how the business works. For example:
- Finance and accounting.
- Tax returns and supporting records.
- Company governance.
- Contracts and suppliers.
- Customers and projects.
- Human resources.
- Policies and procedures.
- Compliance and incident records.
Within each category, use consistent naming conventions. A filename should communicate enough information to identify the document without requiring staff to open every file.
For example, a business might use a pattern such as YYYY-MM-DD_supplier_invoice_reference.pdf. The exact convention matters less than applying it consistently and avoiding unnecessary personal information in filenames.
Maintain a distinction between an authoritative record and a convenience copy. When a document is revised, make clear which version is current and preserve previous versions when required for evidence, governance or contractual purposes.
Where appropriate, record who created or approved an important document, when it was issued and where its supporting evidence is stored.
7. Protect access and maintain reliable backups
Document management is also a security responsibility.
Use permissions that reflect staff responsibilities. Not every employee needs access to payroll records, identity documents, confidential contracts or all customer files.
Practical safeguards include:
- Unique user accounts and strong authentication.
- Multi-factor authentication where supported.
- Restricted access to sensitive folders.
- Secure sharing rather than public file links.
- Backups and a tested restoration process.
- A clear process for removing access when staff leave.
- Secure disposal of documents that are no longer authorised to be retained.
Backups should not become a reason to retain information forever. If a record reaches the end of its approved retention period, the business should have a process for handling copies and backups consistently with its obligations and technical arrangements.
If an external service provider stores personal information for the business, confirm responsibilities for security, access, retention and deletion. POPIA's requirements should be considered alongside the contract and the provider's actual capabilities.
Be careful with cloud storage and overseas records
Cloud storage can make business records easier to share and retrieve, but the location of records and the terms of the service may matter.
SARS's record-keeping guidance notes that authorisation may be required in certain circumstances where electronic records are kept at a location physically outside South Africa. A business should confirm the current requirements with SARS or a qualified tax adviser rather than assuming every cloud arrangement automatically satisfies them.
Also review whether the storage provider offers appropriate access controls, export facilities, backups and deletion processes.
8. Define how records are disposed of
A retention schedule should not merely say when a record can be deleted. It should explain who authorises disposal and how the business confirms that deletion is appropriate.
A workable process might be:
- Generate a list of records approaching their scheduled review date.
- Check for overlapping legal, tax, contractual or company-record obligations.
- Confirm whether any audit, investigation, objection, appeal or dispute is active.
- Check whether personal information remains necessary for a permitted purpose.
- Obtain approval from the responsible person.
- Dispose of the record securely, or de-identify it where appropriate.
- Record the disposal decision and its date.
Paper records containing confidential or personal information should be disposed of in a way that prevents reconstruction of their contents. Digital records require a suitable deletion process, taking account of the systems and backups in which copies may exist.
If the business is unsure whether a record can be destroyed, pause the process and obtain advice. A short delay to confirm the correct requirement is preferable to deleting evidence that must still be retained.
9. Assign ownership of the process
A document policy needs an owner.
In a small business, that may be the owner, an office administrator, a finance lead or another person with suitable responsibility. The important point is that someone is accountable for maintaining the schedule and following up on reviews.
Define who is allowed to:
- Create and approve official documents.
- Change records and replace versions.
- Grant access to restricted information.
- Set or change retention periods.
- Authorise disposal.
- Respond to document requests.
- Escalate uncertainty to an accountant, attorney or other qualified adviser.
Review the policy when the business introduces a new system, starts collecting a different category of personal information, changes providers or enters a new type of contract.
Need a clearer structure for business paperwork? Begin with the documents you use every week and build the policy around how the business actually operates.
Business documentation: Visit Mogen's Business Documentation to explore available business documentation services and discuss practical document-organisation needs.
10. A simple 30-day implementation plan
A small business does not need to digitise every paper file or rewrite every procedure in a single week. Start with the records that matter most.
Week 1: Inventory
List the main record categories, where they are stored, who can access them and which systems contain duplicates.
Week 2: Verify requirements
Ask the accountant or relevant adviser to confirm the retention periods and triggers that apply to tax, company, employment and contractual records. Identify any active disputes or investigations that affect disposal.
Week 3: Organise and protect
Establish a consistent folder structure, naming convention, permissions and backup arrangements. Identify the authoritative version of important documents.
Week 4: Approve the policy
Create a retention schedule, assign responsibility and document the review and disposal process. Train the people who create, store or approve records.
Once the initial work is complete, review the schedule periodically instead of allowing it to become another forgotten policy document.
Website assessment:
If important records are collected through your website, request an assessment to discuss the online enquiry journey and the website changes that may be appropriate. This is a website assessment, not a legal or POPIA compliance audit.
Frequently asked questions
Must South African businesses keep records for five years or seven years?
It depends on the record and the legal requirement. SARS's tax-retention guidance commonly refers to five years under specified conditions. Section 24 of the Companies Act provides a seven-year period for records that a company is required to keep under that Act or another public regulation, with provisions for specific record categories and circumstances. Other obligations may apply.
Does POPIA mean that a business must delete every record after its original purpose ends?
Not necessarily. Section 14 provides exceptions where retention is required or authorised by law, needed for lawful purposes, required by contract or covered by applicable consent. The business must establish the relevant basis rather than keeping personal information without review.
Can business records be stored electronically?
Electronic record keeping is possible, but the applicable requirements still matter. Businesses should ensure that records remain organised, secure, retrievable and available when required. Confirm any location-specific requirements with SARS or a qualified adviser.
Should a small business keep every email?
Not automatically. Identify emails that evidence transactions, approvals, instructions, contractual matters or other important decisions. Apply the relevant retention rules to those records and establish a sensible process for routine correspondence.
Conclusion
Good record management is not simply a matter of choosing a number of years and keeping everything until that date. It requires a clear understanding of the record's purpose, the laws and contracts that apply, and the conditions that may extend or limit retention.
Start with a record inventory, confirm the relevant periods, assign ownership and create a written retention schedule. Keep records secure and retrievable, and ensure that authorised disposal is deliberate rather than accidental.
A modest, consistently followed process can help a growing business stay organised while reducing the risks associated with missing records and unnecessary data retention.