What to Keep, and For How Long

About this guide

Most businesses keep either far too much or dangerously little, because the rules sit in three different pieces of legislation and nobody reads all three. This guide puts the retention periods in one table, with the law that drives each one.

It covers records supporting a tax return under the Tax Administration Act, company records and financial statements under the Companies Act, employment contracts and attendance records under the Basic Conditions of Employment Act, and VAT records and tax invoices under the VAT Act — including the rule that matters most in practice: where an audit, objection or dispute is running, everything connected to it is kept until the matter ends, regardless of the table.

There is a section on whether digital copies are acceptable and what makes them acceptable, a ten-folder filing structure you can set up this week, what to do the day a SARS letter arrives, and what you may safely destroy — including the reminder that POPIA governs how you dispose of documents containing personal information, not only how you store them.

What each section covers

The three sets of rules

Retention is governed by more than one law at once, and the longest period wins. Tax legislation, the Companies Act and employment legislation each impose their own minimums.

Digital copies are acceptable, with conditions

Electronic records are acceptable provided they are complete, readable and can be produced when asked for. · They must be kept in a form that allows SARS to access and inspect them, and they should remain available for the full retention period. · Attaching the source document to the transaction in your accounting system satisfies this and makes retrieval trivial. This is one of the practical arguments for cloud accounting.

A filing structure that works

Organise by year, then by category. Every business we take on that already does this has a shorter, cheaper year end.

If SARS asks

Read the letter and diarise the deadline immediately — the periods are short and strictly applied · Send exactly what was asked for, no more · Keep a record of what you sent and when

What you may safely destroy

Records past every applicable retention period, provided no dispute or audit touches them. · Duplicates, once you are certain the original or a complete digital copy exists. · Destroy paper containing personal information securely — POPIA applies to disposal too, not just storage.