How long to keep client records

Ask most businesses how long they keep client records and the honest answer is forever, because deleting feels risky and storage is cheap. POPIA makes forever unlawful: personal information may only be kept while there is a purpose for keeping it. Other statutes pull the opposite way by forcing minimum periods. The way through is a retention schedule that names both numbers for every type of record.

The floors and the ceiling

Section 14 of POPIA is the ceiling: once the purpose is achieved and no law requires the record, it must be destroyed or de-identified. The floors come from elsewhere. FICA requires accountable institutions to keep client identification and transaction records for five years after the business relationship ends. Tax law expects supporting records for five years. The Companies Act wants accounting records for seven. None of these conflict with POPIA, because retention a law requires is retention POPIA permits. The conflict only appears when nobody has written down which rule covers which record.

What a retention schedule looks like

One table, maintained like any other operational document, with a row per record type:

  • The record: what it is and where it lives.
  • The basis: why you hold it, and the statute that sets a minimum period if one does.
  • The trigger: the event that starts the clock, such as the end of the client relationship.
  • The period: how long after the trigger the record survives.
  • The exit: deletion or de-identification, and which system performs it.

Make the systems do the deleting

A schedule that relies on a person remembering to purge records each quarter decays within a year. The durable version is automated: the trigger and period live in the system holding the records, and expiry runs as a scheduled job that logs what it removed. POPIA also accepts de-identification instead of deletion, which suits reporting, because stripped of names and identifiers the record can feed your statistics indefinitely.

Does anything in your systems ever actually get deleted? Tell us what’s on fire