How long to keep closed matter files
How long a South African law practice should keep closed matter files and client records, and when POPIA expects it to destroy or de-identify them.
By Achekam · · 5 min read · For Legal businesses in South Africa
The storeroom at the back of the practice is full of boxes. Some hold matters closed last year; some go back to partners who retired long ago. Nobody is sure what can be shredded, so nothing is. Meanwhile the scanned files on the server grow every year, and a client from a decade back has just asked what personal information the practice still holds about them.
Keeping everything forever feels safe. It is not. As the Law Society's guidelines on the Protection of Personal Information Act explain, personal information must be destroyed or de-identified once there is no longer authority to keep it, while other laws require some records to be kept for set periods. A retention schedule reconciles the two. This piece explains the main rules that shape one for a South African law practice, and how to show that archived files were not changed.
POPIA: no longer than necessary
The Law Society of South Africa's POPIA guidelines for attorneys state that attorneys must not keep personal information longer than necessary for its purpose unless the law requires it, it is needed for lawful purposes, a contract provides for it, or the data subject has consented. Once the practice is no longer authorised to retain it, the information must be destroyed, deleted or de-identified.
That is the default: keep only as long as you need, then dispose of it properly. The other rules in this piece are the main reasons "as long as you need" is longer than the matter itself. Handling client files under POPIA during the matter is covered in client files under POPIA.
FIC Act records: five years after the relationship ends
The Financial Intelligence Centre states that accountable institutions must keep records of client information, transactional information and regulatory reports for at least five years from the termination of the business relationship, the conclusion of a once-off transaction, or the submission of a report to the FIC.
Where the practice is an accountable institution, that means the identification documents and verification records collected when the client was taken on, the records of transactions, and any reports made to the FIC must survive at least five years from the relevant event. Note that the clock starts when the relationship ends, not when an individual matter closes. A client with several matters over many years is one relationship.
Company and accounting records: seven years
The Companies Act, as published, sets the period for a company's own records. Under section 24(1), anything the company has to keep under that Act or another public regulation must be held in writing, or in a form that can be turned into writing within a reasonable time, for seven years, unless another regulation sets a longer period. Section 24(3) is more specific: a copy of each set of annual financial statements stays for seven years from the date it was issued, and the accounting records cover the current financial year plus the seven completed years before it.
For an incorporated practice, those rules govern its own books: fee notes, receipts, supplier bills, the ledger and the annual financial statements. They are not a rule about every client's matter file, but they often set the longest period on the schedule.
Electronic copies that still count
The ECT Act, as published, deals with keeping those records electronically. Section 16(1) says that when a law requires information to be kept, an electronic copy satisfies it on three conditions: the information can be reached and read later; it stays in its original format, or in one that can be shown to represent it accurately; and it remains possible to tell where it came from, where it went, and when it was sent or received.
That opens the way to scanning paper files and disposing of the boxes, as long as the scans meet those conditions. A scan nobody can find, or an e-mail stripped of its sender and date, does not.
A retention schedule by record type
Write the schedule as a table, with the reason for each period, and review it with your compliance officer:
| Record | Keep for at least | Reason | Then |
|---|---|---|---|
| Client identification and verification records | Five years after the relationship ends | FIC requirement, where it applies | Destroy or de-identify |
| Transaction records and FIC reports | Five years from the event the FIC names | FIC requirement, where it applies | Destroy or de-identify |
| The practice's accounting records | Current year plus seven completed years | Companies Act section 24(3) | Destroy |
| Annual financial statements | Seven years after issue | Companies Act section 24(3) | Destroy or keep by choice |
| Matter correspondence and working papers | As long as a lawful purpose remains | POPIA, as the LSSA explains | Destroy or de-identify |
The last row is the one to think about hardest: possible claims, professional rules, and anything the client agreed. Record the reason you chose, so the decision can be explained.
Archiving files and showing they were not changed
Achekam's Document Centre organises files in folders that can be uploaded whole, tagged, searched and archived, and replacing a file with a new version leaves the earlier versions in place. Archive a matter's folder when it closes, tagged with its closing date and its destruction date from the schedule, so the folders due for review can be found each year.
Each file stored there is given a SHA-256 fingerprint, worked out from its contents, so that any change to the file produces a different value. Uploads are also checked for malware, and executable files are turned away unless the default is changed. If a file's integrity is ever questioned, the fingerprint helps show that the archived copy is the one originally stored, which speaks to the ECT Act's "format shown to represent it accurately".
The books need protecting too. Months can be soft-closed, hard-closed and locked; a closed month refuses postings from every source, and reopening a hard close needs a second approver. Locked years keep the accounting records the Companies Act asks for in the state they were in. Closing a matter with a final account and keeping matter files in Document Centre cover the steps at the end of a matter.
The LSSA's POPIA guidelines for attorneys explain how the Act applies to law firms, including how long client information may be kept.
Agree the schedule this quarter, tag each closed matter with its destruction date, and hold the first annual review. The storeroom will empty, slowly and lawfully.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
