SARS Record Keeping: how long to keep every record, and the Act each period comes from

SARS requires you to keep tax records for five years, and the clock runs from the date you submitted the return, not the date on the invoice. That answer is incomplete in both directions: the Companies Act asks seven years for company records, and POPIA requires you to delete personal information once its purpose ends.

Five years is the number everyone quotes. It is right for one Act and wrong for the shelf as a whole. Below is every period that applies to an ordinary South African company, with the section it comes from, because the section is the part that is almost never published.

What the law actually says, row by row

Each row below carries its own clock and its own starting event. The starting event is the part that catches people out, and it is different in almost every row.

Record	How long	Clock starts	Authority
Records supporting a submitted return (income tax, VAT, PAYE)	5 years	Date you submitted the return	Tax Administration Act 28 of 2011, s29(3)(a)
Records where no return was required	5 years	End of the relevant tax period	Tax Administration Act, s29(3)(b)
Records where a return was required and never submitted	No end date is stated	Does not start	Tax Administration Act, s29(2)(b), read against s29(3)
Anything relevant to an audit, investigation, objection or appeal	Until it concludes or the assessment becomes final	Overrides the five years	Tax Administration Act, s32
Company records generally	7 years, or longer if another public regulation says so	Per the record	Companies Act 71 of 2008, s24(1)(b)
Annual financial statements	7 years	Date the statements were issued	Companies Act, s24(3)(c)(ii)
Accounting records	Current financial year plus the previous 7 completed financial years	Rolls with the year end	Companies Act, s24(3)(c)(iii)
Record of a director	7 years	After that person ceases to serve as a director	Companies Act, s24(3)(b)(i)
Minutes and resolutions of directors	7 years	Date of the meeting, or the date the resolution was adopted	Companies Act, s24(3)(f)
Shareholder meeting notices, minutes and resolutions	7 years	Date each resolution was adopted	Companies Act, s24(3)(d)(i)
Employee records of time worked and pay	3 years	Date of the last entry in the record	Basic Conditions of Employment Act 75 of 1997, s31(2)
Personal information, once its purpose is finished	Must not be kept longer than necessary, then destroyed or de-identified	When you are no longer authorised to hold it	POPIA 4 of 2013, s14(1) and s14(4)
Accountable institution records under FICA	5 years	Termination of the business relationship, or conclusion of the transaction	Financial Intelligence Centre Act 38 of 2001, s23

One softening clause is worth knowing. Section 24(2) of the Companies Act says that if the company has existed for a shorter time than seven years, it only has to retain records for that shorter time. A company incorporated in 2023 is not in breach for having no 2019 file.

The five year answer is wrong in both directions

This is the practical point, and it is why a single number does more harm than good.

Too short for company records. Section 24(1)(b) of the Companies Act sets seven years for documents, accounts, books, writing, records or other information the company must keep under that Act or any other public regulation. A business that clears its shelf at five years on SARS advice has just destroyed company records two years early.

Too long for personal information. Section 14(1) of POPIA says records of personal information "must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed", with named exceptions including where retention is required or authorised by law. Section 14(4) then goes further and makes it active rather than passive: the responsible party "must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable" once it is no longer authorised to hold it. Section 14(5) requires that the destruction prevent reconstruction in an intelligible form.

Read those two together and the shelf is not one pile with one date on it. A supplier invoice and a job applicant's CV are governed by opposite instincts. The invoice must be kept, and it has to be a valid tax invoice in the first place for the deduction behind it to survive. The CV must go, unless you can point to the law, the contract, the consent or the lawful business purpose that lets you keep it. Our POPIA compliance checklist works through that second test in detail.

The clock starts later than you think, and sometimes not at all

Section 29(2) of the Tax Administration Act describes three kinds of person: one who has submitted a return for the tax period, one who was required to submit a return and has not, and one who was not required to submit but had income, a capital gain or loss, or engaged in another activity subject to tax.

Section 29(3) then relieves the retention duty for two of those three. Records "need not be retained" by the person who submitted, after five years from the date of the submission of the return, and by the person who was not required to submit, after five years from the end of the relevant tax period.

The middle category is not listed in section 29(3). On the face of the Act, the person who was required to file and did not is not given an expiry date at all, because the event the five years runs from never happened.

SARS publishes its own summary of this in GEN-GEN-23-POL02, Manage taxpayer record retention authorisation, External Policy, effective 27 November 2023. That document states the requirement as "five years from the date of submission of a return or if no return is required, five years from the end of the relevant tax period". Two categories, not three. The non-filer is not mentioned in SARS's own external policy summary either.

This is not offered as a legal opinion, and if you have unfiled returns behind you it is a conversation for your tax practitioner rather than a blog. It is set out here because it is plainly visible in the text of the Act, it changes what you should do with an old box, and it does not appear on the competing pages that publish the five year figure.

Two things quietly extend every period above

An audit or an objection. Section 32 of the Tax Administration Act opens with the words "Despite section 29(3)". Once you have been notified of or are aware of an audit or investigation, or you lodge an objection or appeal, the relevant records must be kept until the audit or investigation is concluded or the assessment or decision becomes final. The five years stops being the answer the moment that letter arrives.

Any other public regulation. Section 24(1)(b) of the Companies Act sets seven years "or any longer period of time specified in any other applicable public regulation". Industry rules sit on top of this table rather than replacing it, so a licensed or regulated business should check its own regulator before treating seven years as the ceiling.

Keeping is not the hard part

Almost nobody fails the retention test by throwing things away too early. They fail it by keeping everything and being unable to produce one document when it is asked for.

Section 24(1)(a) of the Companies Act is the clue. It does not require a document. It requires records kept "in written form, or other form or manner that allows that information to be converted into written form within a reasonable time". That is a retrieval standard written in the language of a storage standard. A drive holding thirty thousand unnamed scans satisfies the keeping and fails the converting.

Where those records are allowed to live, what makes an electronic copy count as the record, and how fast you have to produce one are separate questions with their own rules. They are worked through in our companion piece on document management in South Africa, and this post deliberately does not repeat them. The periods are here. The storage rules are there.

How this work actually gets reduced

The retention table is not something a business should be reading off a page each time. It is a set of rules that can be attached to records once, at the point where each record is created.

What that looks like in practice:

1. Capture the trigger date, not just the document. Every row above runs from an event: the submission date, the issue date, the date a resolution was adopted, the date someone stopped being a director, the date of the last entry on an employee record. If that date is captured as a field when the record is filed, every period in the table becomes a calculation rather than a judgement call.
2. Attach the class once. A document is tax, company, employment, personal information, or more than one of those. Classified at intake, it never has to be re-read to work out which clock it is on.
3. Let the review date come to you. A record that reaches the end of its period should surface on a list by itself. Under POPIA this matters in the direction people forget, because section 14(4) requires action, and nothing will prompt that action unless something is watching the date.
4. Freeze on dispute. Section 32 needs a switch, not a memory. When an audit or objection is opened, the affected records need a hold that survives whoever happens to be doing the filing that month.
5. Index for retrieval, not for tidiness. The test that matters is producing a named document within a reasonable time. Consistent naming and a searchable index are what convert a compliant pile into a compliant record. Name a record for what it is, not for the day it arrived, because the date is the first thing you forget and the subject is the only thing you ever search for.

Those five steps are an instance of a general pattern rather than a filing trick. The same reasoning is set out at greater length in our piece on business process automation: capture the fact once, at the point it is known, and stop re-deriving it later.

None of that requires new software as a first step. It requires deciding, once, what each kind of record is and when its clock started. The tooling is the easy half. The same principle runs through tracking business expenses for SARS, where the cost of the work is almost entirely in re-deriving information that was available at the moment the record was created.

Retention is one line item on a longer list. Our business compliance checklist for South Africa sets out the rest of the annual obligations that sit alongside it.

Frequently Asked Questions

How long must I keep records for SARS?

Five years. Section 29(3)(a) of the Tax Administration Act runs that period from the date you submitted the return, and section 29(3)(b) runs it from the end of the tax period where no return was required. Section 32 extends it if an audit, objection or appeal is open.

Is it five years or seven years?

Both, for different records. Five years is the tax rule in section 29(3) of the Tax Administration Act. Seven years is the company rule in section 24(1)(b) of the Companies Act. A company keeping only five years is short on its company records.

Can I keep the records electronically?

Yes. Section 30(1) of the Tax Administration Act allows records to be kept in an electronic form prescribed by the Commissioner by public notice, or in a form specifically authorised by a senior SARS official. Where those records physically sit is a separate question with its own rules.

How long must I keep employee records?

Three years. Section 31(2) of the Basic Conditions of Employment Act requires the record of an employee's details, time worked and remuneration to be kept for three years from the date of the last entry in that record, not from the date employment ended.

Does POPIA mean I have to delete things?

Yes, in some cases. Section 14(4) of POPIA requires a responsible party to destroy, delete or de-identify a record of personal information as soon as reasonably practicable once it is no longer authorised to retain it, and section 14(5) requires that this prevents reconstruction.

Where to start

Pick the five kinds of record your business creates most often, write down the event each one's clock starts from, and check whether that date is captured anywhere today. In most businesses it is not, which is why the answer to "how long do we keep this" defaults to forever.

If working out which records you hold, where they sit and how quickly you could produce one is the part you would rather not do alone, that is what a business autopsy is for: the records, the clocks and the retrieval path get mapped before anyone proposes a system.

Sources

• Tax Administration Act 28 of 2011, sections 29, 30, 31 and 32.
• Companies Act 71 of 2008, section 24.
• Protection of Personal Information Act 4 of 2013, section 14.
• Basic Conditions of Employment Act 75 of 1997, section 31.
• Financial Intelligence Centre Act 38 of 2001, sections 22 and 23. Applies to accountable institutions listed in the Act's schedule, not to every business.
• South African Revenue Service, GEN-GEN-23-POL02, Manage taxpayer record retention authorisation, External Policy, effective 27 November 2023.

This is general information about what the legislation says, not legal or tax advice for your business. Where a period is close to expiring or a dispute is open, check it with your own practitioner.