Records & POPIA
Records-Retention Compliance
Keeping records too long breaches POPIA's retention limits, while destroying them too soon breaches archival law and destroys audit evidence.
Why Retention Compliance Matters
Records management in the public sector is governed by the National Archives and Record Service of South Africa Act and POPIA's retention-limitation requirements, which together demand that records be kept for as long as needed and disposed of properly thereafter. Adherence to approved retention and disposal schedules protects both legal compliance and the availability of audit evidence the AGSA will demand. AuditPro Core tracks compliance against retention schedules by record class so neither over-retention nor premature disposal goes unnoticed.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Classes compliant
73%
▲ 6 pts
Overdue disposal
1,840
records
Retained too short
12
classes
Schedule coverage
91%
Retention status by record class
Classes overdue for disposal
| Record class | Records | Years over | Action |
|---|---|---|---|
| Contracts (expired) | 620 | 3 | Dispose |
| HR (terminated) | 480 | 2 | Dispose |
| Case files (closed) | 410 | 4 | Review |
| Correspondence | 330 | 2 | Dispose |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Retention schedules
An approved retention schedule sets how long each record class must be kept and when it may be disposed of. Compliance means records are neither destroyed early nor hoarded indefinitely against that schedule.
The dual risk
Over-retention breaches POPIA's storage-limitation condition and increases data-breach exposure, while premature disposal destroys evidence and may breach the Archives Act. Both directions are non-compliant and the dashboard tracks each.
Disposal authorisation
Disposal of public records requires proper authorisation and a record of the disposal itself. Unauthorised or undocumented destruction is a serious governance and evidential failure.
How AuditPro Core Bridges the Gap
- Schedule reconciliation: record holdings are matched against approved retention periods by class.
- Exception workflow: over-retained and prematurely disposed records are flagged for action.
- Traceability to source: disposals link to their authorisation and disposal certificate.
- Audit-ready export: the retention-compliance register exports as evidence for records governance and POPIA storage limitation.
Key Takeaways
- Compliance runs in both directions — over-retention and premature disposal each breach the law.
- Approved schedules, not ad hoc judgement, define correct retention.
- Disposal must be authorised and documented to be defensible.
- Sound retention protects both POPIA compliance and the availability of audit evidence.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.