Document management software stores, organises and controls access to your business's files in one searchable system. In South Africa it also has to carry a legal load: SARS requires most tax records for five years, the Companies Act requires seven, and POPIA requires you to delete personal information once its purpose has ended.
Most South African businesses do not have a document problem. They have a findability problem. The signed contract exists — it is in someone's inbox. The proof of payment exists — it is a WhatsApp photo on a phone that has since been replaced. The 2022 management accounts exist — probably, on a laptop that left with a bookkeeper.
That is tolerable right up until the moment it is not: a SARS verification, a POPIA access request, a dispute where the version of the contract you can find is not the version that was signed. Document management software is the difference between answering those requests in an afternoon and answering them in a fortnight.
Here is what the law actually asks of you, what to look for in a system, and what it costs.
How long must a South African business keep its records?
Retention periods in South Africa come from several statutes at once, and they do not agree with each other. The practical rule is simple: the longest applicable period wins.
| Record type | Minimum retention | Where it comes from |
|---|---|---|
| Tax records supporting a submitted return | 5 years from the date the return was submitted | Tax Administration Act, s29 |
| Tax records where no return was required | 5 years from the end of the relevant tax period | Tax Administration Act, s29 |
| Company records, accounting records, annual financial statements, minutes and resolutions | 7 years | Companies Act 71 of 2008, s24 |
| Memorandum of Incorporation, notice of incorporation, securities register | Indefinitely | Companies Act 71 of 2008, s24 |
| Employee terms of employment, hours worked, remuneration | 3 years from the last entry, and 3 years after termination | Basic Conditions of Employment Act, s31 |
| Personal information with no other legal basis to retain it | Only as long as the collection purpose requires | POPIA, s14 |
Two riders matter. If SARS has notified you of an audit or investigation, the relevant records must be kept until it concludes. If an assessment is in dispute, the supporting documents must be kept until the assessment becomes final — regardless of where the five years falls.
Notice the tension in that last table row. Most legislation sets a floor on how long you keep things. POPIA sets a ceiling. A document system that only knows how to store, and never how to expire, solves half the problem and quietly creates the other half.
Does SARS accept electronic records?
Yes — and this is where a lot of South African businesses are running on assumptions that no longer hold.
Electronic retention is permitted, but conditionally. Section 16 of the Electronic Communications and Transactions Act says a legal requirement to retain information is met by a data message only where three things are true:
- the information remains accessible and usable for later reference;
- it is held in the format in which it was generated, sent or received, or a format that demonstrably represents that information accurately; and
- the origin, destination, date and time of the record can be determined.
A folder of loose PDFs on a shared drive can satisfy the first condition and fail the third entirely. Metadata is not decoration — it is part of what makes the record legally useful.
SARS adds a further requirement that catches almost everyone off guard: records kept in electronic form must be held at a place physically located in South Africa, unless a senior SARS official authorises otherwise. That authorisation is not automatic. It follows a declaration to SARS, an undertaking that the records can be produced in a readable, correctly analysable electronic format, and that they can be produced within 90 calendar days of a request.
Read that against your actual stack. If your accounting documents sit in a cloud tenant provisioned in Europe or the United States by default, the question of where your data physically lives stops being a technical footnote and becomes a compliance question. Most reputable providers let you choose a region — but only if someone chooses it deliberately.
Confirm your own position with your accountant or tax practitioner, and check the current SARS public notices before you rely on a specific arrangement. Requirements in this area have been revised more than once.
What does POPIA require of your document storage?
POPIA governs the personal information inside your documents — every ID number on a contract, every address on a delivery note, every CV in a hiring folder.
Section 14 sets the retention ceiling: you may not keep records of personal information longer than is necessary for the purpose they were collected for, unless retention is required or authorised by law, needed for your lawful business functions, required by contract, or consented to. When you are no longer authorised to hold a record, you must destroy, delete or de-identify it as soon as reasonably practicable — in a way that prevents its reconstruction in an intelligible form. Dragging a folder to a recycle bin is not that.
The Information Regulator can issue administrative fines of up to R10 million, and serious offences carry the possibility of imprisonment. Fines issued to date have been substantially smaller and have generally followed an ignored enforcement notice rather than arriving out of nowhere — but the direction of travel is clear, and "we could not find the record" is not a defence that improves with time.
Practically, POPIA asks three things of a document system:
- Know what you hold. You cannot honour an access or deletion request over files you cannot search.
- Control who sees it. Permissions by role, not by whoever happens to have the link.
- Expire things on schedule. Retention rules that run automatically, with a log of what was deleted and when.
We cover the broader compliance picture in our POPIA overview.
What features actually matter in a document management system?
Vendor feature lists are long. The list that changes your working week is short.
Search that reads the document, not the filename. Optical character recognition turns a scanned delivery note into searchable text. Without it, "find every document mentioning invoice 4471" is a manual task.
Version control and an audit trail. One document, many versions, with a record of who changed what and when. This is what turns a file into evidence.
Permissions by role. Finance sees finance. HR sees HR. Contractors see the one folder they need. Link-sharing is convenience; role permissions are control.
Retention and deletion rules. The system should know that a supplier invoice is kept for seven years and a rejected job applicant's CV is not. Storage is easy. Expiry is the part that requires design.
A clear answer on data residency. Ask where the data is physically stored, and get the answer in writing before you migrate anything.
Integration with the systems that create the documents. This is the one most businesses underweight, and the one that determines whether the system is actually used.
Bulk export. If you cannot get your documents out in a usable structure, you do not own your archive — you rent it.
How much does document management software cost in South Africa?
South African businesses generally choose from five bands. The figures below are indicative, converted from published international list prices at roughly R16 to the US dollar in August 2026, and exclude VAT.
| Option | Indicative cost | Best when |
|---|---|---|
| General cloud storage (Google Workspace, Microsoft 365 with SharePoint) | ~R100–R250 per user / month | Small teams, informal filing, documents that rarely need to be found under pressure |
| Team document platform (Zoho WorkDrive-class) | ~R40–R180 per user / month | You need shared team folders, permissions and versioning without a full compliance layer |
| Dedicated enterprise DMS (DocuWare-class) | ~R400–R1,600 per user / month, usually quoted | High document volume, heavy approval workflows, regulated environments |
| Documents inside your operations platform | Included in the platform subscription | You want each document attached to the customer, invoice or job that produced it |
| Custom document layer | Project cost | Unusual retention rules, specific residency requirements, or integration with systems nothing off the shelf speaks to |
Exchange rates move, vendors reprice, and per-user costs compound quickly across a growing team. Treat every number above as a starting range and book a scoping call for a fixed quote against your actual document volumes.
Should you buy a DMS, or build documents into your operations platform?
This is the question worth sitting with, because it is not really about documents.
A standalone document management system is a filing cabinet with excellent search. It is the right answer when documents are the work — conveyancing, medical records, claims processing, anywhere the file is the asset.
For most agencies and growing South African businesses, documents are not the work. They are the residue of the work. A quote is produced by a sales process. An invoice is produced by a billing process. A signed SLA is produced by an onboarding process. Filing them in a separate system means someone has to remember to move them there — and someone will stop remembering, usually in month three.
The alternative is to let documents live where they were created. In Syniq's Business OS, the quote sits on the deal, the tax-compliant invoice sits on the customer, and the support attachment sits on the ticket. Nobody files anything, because nothing needs filing. Retention rules apply to the record and its documents together, and the audit trail is a by-product of doing the work rather than a separate discipline.
Where an existing system genuinely cannot be moved — a legacy line-of-business application, an industry-specific tool with no alternative — the answer is usually a custom integration layer that keeps documents flowing to one authoritative place rather than a second archive nobody maintains.
If you are weighing subscription cost against the cost of the current mess, our Business OS pricing is a reasonable place to start the arithmetic.
Where to start
Do not begin with software. Begin with a list.
Write down the last five documents you struggled to find, and where each one eventually turned up. That list will tell you whether your problem is search, permissions, retention or process — and those four problems have four different solutions. Buying a document management system to solve a process problem is an expensive way to relocate the mess.
Once you know which problem you have, the tooling decision takes about a week.
Ready to stop hunting for files? Book a no-obligation discovery call. We will map where your documents are created, where they end up, and what it would take to make them findable in one place — whether that is Business OS, a custom build, or a change to how your current tools are configured.
Frequently asked questions
How long must I keep business records in South Africa? The longest applicable period applies. Tax records must be kept for five years under the Tax Administration Act, company and accounting records for seven years under the Companies Act, and employee records for three years under the BCEA. Some company records — the MOI and securities register — are kept indefinitely. If SARS has opened an audit or an assessment is in dispute, keep the relevant records until the matter concludes.
Can I throw away the paper once I have scanned it? Generally yes, provided the electronic version meets the ECTA section 16 conditions: it stays accessible for later reference, it is held in the original format or one that demonstrably represents it accurately, and its origin, destination, date and time can be determined. Scanning to a well-indexed system with intact metadata satisfies this. Scanning to an unsorted folder of image files often does not. Confirm your specific position with your accountant.
Does SARS allow my documents to be stored on overseas cloud servers? Records kept in electronic form must be held at a place physically located in South Africa unless a senior SARS official authorises otherwise. That authorisation follows a declaration to SARS and an undertaking that the records can be produced in a readable, analysable electronic format within 90 calendar days of a request. Check where your current cloud tenant is provisioned, and verify the current SARS public notices before relying on an offshore arrangement.
What is the difference between cloud storage and a document management system? Cloud storage gives you folders, sharing and file-name search. A document management system adds full-text search inside documents, version history, role-based permissions, workflow and — critically — automated retention and deletion. Storage answers "where is the file". A DMS answers "who changed it, who may see it, and when should it be destroyed".
How much does document management software cost in South Africa? Indicatively, general cloud storage runs roughly R100–R250 per user per month, team document platforms roughly R40–R180, and dedicated enterprise systems roughly R400–R1,600 per user per month on a quoted basis. All figures exclude VAT and reflect international list prices converted at about R16 to the dollar. Book a scoping call for a fixed quote against your document volumes.
Do I still need a DMS if my business software already stores files? Often not. If your operations platform attaches documents to the customer, deal, invoice or job that created them, and applies retention rules to that record, you already have the useful part of a document management system without a second place to file things. A dedicated DMS earns its cost when documents are the product — conveyancing, claims, medical records — rather than the residue of other work.
This article explains publicly available South African record-keeping and data-protection requirements. It is not legal or tax advice — Syniq is a software company. Speak to your accountant, tax practitioner or attorney about how these rules apply to your specific circumstances.