Employee Data Retention: What to Keep, For How Long, and What to Destroy
Employee data retention is where the BCEA and POPIA pull in opposite directions — one says keep, the other says do not keep forever — and the employer’s job is to honour both. The answer is a retention schedule: every record type, its legal minimum, its practical life, and its destruction date. This guide gives you that schedule, record by record.
- ✔BCEA employment records: keep at least 3 years from termination.
- ✔SARS payroll and tax records: keep 5 years.
- ✔POPIA sets the ceiling — destroy securely once purpose and law allow.
- ✔Unsuccessful applicants’ CVs: short stated period, then destroy — or get consent to keep.
- ✔Destruction means shredding and secure deletion — not the rubbish bin.
The statutory minimums: employee records the law says you must keep
Two regimes set the floors. The BCEA requires employers to keep employment records — contracts, remuneration, leave, hours — for three years from termination of employment. SARS requires payroll and tax records — payslips, EMP201s, EMP501s, IRP5s, supporting documents — for five years. UIF and COIDA records should follow the same five-year discipline, since claims and audits can reach back.
| Record type | Keep for | Driver |
|---|---|---|
| Employment contracts and BCEA records | 3 years after termination | BCEA |
| Payslips, EMP201s, EMP501s, IRP5s | 5 years | SARS |
| UIF declarations and UI-19s | 5 years (match SARS) | Prudence / claims |
| COIDA ROEs and claim files | 5 years minimum | Compensation Fund |
| Disciplinary and grievance records | Employment + 3 years | CCMA defence |
| Leave and attendance records | 3 years | BCEA |
| Medical certificates and health info | 3 years, restricted access | BCEA + POPIA special rules |
| Unsuccessful applicants’ CVs | Up to 12 months, then destroy | POPIA purpose limitation |
These dovetail with the broader BCEA record-keeping rules — the retention schedule is the record-keeping system seen from POPIA’s side.
The POPIA ceiling: when keeping becomes breaking
POPIA’s retention rule is the mirror image: personal information must not be kept longer than necessary for the purpose, unless the law requires longer or the person consents. Once the statutory period and any genuine need (a pending dispute, an audit) have passed, the record must be destroyed or de-identified. The employee file from 2009 in the ceiling boards is not caution — it is a standing contravention.
Unsolicited and unsuccessful CVs accumulate in inboxes and drawers indefinitely — each one a bundle of personal information kept past its purpose. Set a rule: unsuccessful applications are destroyed after a stated period (six to twelve months is defensible), unless the applicant consented to staying in the talent pool.
Pending disputes override the schedule: if a CCMA matter, audit or claim is live, preserve everything relevant until it closes — destruction then would be spoliation. The schedule runs; litigation holds suspend it.
Secure destruction: the last step that counts
- Paper: cross-cut shredding or a certified destruction service — never intact documents in general waste.
- Digital: secure deletion from live systems, backups cycled out, old devices wiped before disposal or resale.
- Certificates: for bulk destruction, a destruction certificate from the service provider belongs in your compliance file.
- Log it: a simple destruction register — what, when, how, by whom — proves the schedule is real.
The annual rhythm that makes this effortless: every year after the EMP501 season, review the archive, destroy what has aged out, log it, done. Ten minutes a year of scheduled destruction beats a decade of accumulating liability. The full POPIA framework is in the POPIA pillar guide.
Always confirm current requirements with the official source — rules and deadlines change.
- ✔Admin Boss handles registrations, filings and payroll admin
- ✔Registered tax practitioner · 20+ years experience
- ✔Fully remote — all 9 provinces
Frequently asked questions
How long must I keep employee records in South Africa?
Three years after termination for BCEA employment records, and five years for SARS payroll and tax records. UIF and COIDA records are best kept on the same five-year discipline. After the statutory periods and any live disputes end, POPIA requires secure destruction.
How long can I keep unsuccessful job applicants' CVs?
Only as long as the recruitment purpose lasts — a stated period of six to twelve months is defensible — unless the applicant consents to being kept in a talent pool. Indefinite CV retention is one of the most common POPIA breaches.
Can I destroy records while a CCMA case is pending?
No — live disputes, audits and claims override the retention schedule. Preserve everything relevant until the matter closes; destroying relevant records mid-dispute is spoliation and will damage your case.
How should employee records be destroyed?
Paper by cross-cut shredding or certified destruction; digital by secure deletion, backup cycling and device wiping. Keep a destruction register — and certificates for bulk destruction — as proof the schedule operates.
Do I need a written retention schedule?
Not by name in the statutes — but POPIA requires retention to be limited and justified, and a written schedule is the only practical proof. One page per record type, reviewed annually, is the standard inspectors and the Regulator respond to.
Last reviewed: July 2026 · How we research our guides
EmployerGuide.online provides general information about South African employer obligations — not legal, tax or professional advice for your specific situation. Laws, rates and deadlines change; confirm current requirements with the official sources linked above, or ask Admin Boss. See our disclaimer.