Invoice record keeping requirements in South Africa

As a rule of thumb, South African businesses should keep invoices, credit notes, receipts and payment records for at least five years from the date of the relevant tax return under the Tax Administration Act, and seven years where the Companies Act applies, whichever is longer. Records must be kept longer if SARS has an audit, objection or appeal open, and they must be complete, accessible and in a form SARS can read.

This is a general summary. SARS's record keeping page and your accountant are the authorities for your situation.

The main retention rules

If both the five-year and seven-year rules apply, follow the longer one. Many businesses simply keep all financial records for seven years.

What to keep

For a billing or subscription business, your records should include:

• Sales invoices and tax invoices, including copies of every invoice issued. See valid tax invoice requirements.
• Credit and debit notes, linked to the original invoices.
• Receipts and payment records: gateway reports, debit order collection and unpaid reports, bank statements, proofs of payment.
• Supplier invoices supporting input VAT claims.
• Contracts and debit order mandates supporting what you billed and collected.
• VAT returns and working papers, and reconciliations that tie returns to your ledgers.
• General ledger, journals and year-end financial statements.
• Payroll records if you have employees.

Electronic records

You can keep records electronically, and most businesses now do. SARS's rules on electronic record keeping require that records are:

• Complete and accurate, with their integrity maintained (no undetected changes).
• Accessible and readable, and can be produced in a form SARS can use when asked.
• Backed up.
• Kept in South Africa, unless SARS has authorised otherwise or the rules allow storage elsewhere with access. Check the current requirements if your cloud provider stores data abroad.

Practical implications:

• Keep invoices as generated PDFs, not just in a system that could change them later.
• Don't delete invoices; cancel them with credit notes.
• Make sure you can export records if you change software or your provider shuts down.
• Keep an audit trail of changes to financial records.

Balancing retention with POPIA

POPIA says personal information mustn't be kept longer than needed, but it allows retention where a law requires it. That means:

• Keep invoices and payment records for the tax and company law periods.
• Delete or de-identify personal information that isn't needed for those records once the periods expire (for example full bank account numbers of long-gone customers, marketing preferences, support notes).
• Document your retention schedule so you can explain why you kept or deleted something. See POPIA and customer payment data.

A simple retention schedule

Adjust with your accountant; this is a starting point, not a rule.

Common problems

• Invoices only in email. If a staff member leaves or a mailbox is deleted, records disappear. Keep them in your billing or accounting system.
• Spreadsheets as the only record. Hard to prove integrity; easy to change.
• No link between payments and invoices. You'll struggle to explain receipts to SARS or an auditor. See reconcile EFT payments.
• Old systems nobody can access. Before migrating software, export and archive history.

How CentraPoint helps

CentraPoint keeps every invoice, credit note, payment, debit order collection and mandate against the customer record, with branded PDFs that don't change after issue and an audit log of user activity. You can export data and reports at any time, and sync invoices and payments to Xero, QuickBooks, Zoho Books or Sage so your accounting records match. See invoices and reconciliation in the docs.

Frequently asked questions

How long must I keep invoices for SARS?

Generally five years from the date the relevant return was submitted, or longer if an audit, objection or appeal is ongoing. Companies should keep accounting records for seven years under the Companies Act.

Can I keep invoices electronically only?

Yes. Electronic records are acceptable if they're complete, accurate, accessible and can be produced to SARS in a readable form when requested.

Can I delete customer data because of POPIA?

You can delete personal information you no longer need, but not records that a law requires you to keep, such as tax invoices within the retention period.

What happens if I can't produce records for SARS?

SARS may disallow deductions or input VAT claims, estimate your tax, and impose penalties. Complete records are your best defence in an audit.