South African accountants and bookkeepers

Compliance and data protection for accounting practices.

Client ledgers, payroll, tax submissions and supporting documents need controlled access and reliable retrieval. A practice needs to know what it holds for each client, who is responsible for it and how it will be handed back or recovered.

The regulatory context

Start with the engagement and the services performed.

Bookkeeping, tax work, company administration, financial advice and statutory audit are different activities. A professional title alone does not establish every regulatory obligation.

Tax and company records

Keep retention tied to the record and client.

Tax records generally need retention for five years from submission of the relevant return, with exceptions and longer holds. Companies Act section 24 has separate company-record duties, including accounting records for the current and previous seven completed financial years.

An engagement should identify custody, access, handover and retention responsibilities. Outsourcing record storage does not remove the client's underlying duties.

Sources: SARS retention policy; SARS Tax Administration guide; Companies Act, section 24.

FIC: assess the activity

Check whether trust or company services fall in scope.

FIC PCC 6A explains that trust and company service provider status under Schedule 1 item 2 depends on activities performed. Accounting practices can fall within it; ordinary bookkeeping does not establish that status merely because the provider is an accountant.

Assess each relevant service and client relationship. Where accountable-institution duties apply, include registration, due diligence, recordkeeping, reporting and the risk management and compliance programme.

Sources: FIC PCC 6A; FIC Guidance Note 7B.

POPIA and client confidentiality

Identify your role for each processing activity.

A practice may determine purposes for some processing and act under a client's mandate for other work. Assess the responsible-party and operator roles from the actual arrangement rather than applying one label to the entire practice.

Payroll, identity and banking records need appropriate safeguards. Review access across clients, supplier arrangements and lawful retention.

Sources: POPIA.

This guide covers selected information and IT matters. It is not a complete legal checklist or a finding that your organisation complies. Confirm applicability with the people responsible for your legal, regulatory and operational duties. See the general Compliance page for the wider context, including PAIA.

Keep what is required, for the right reason

Do not use one retention setting for every client file.

A records schedule should identify which return, financial year, engagement or FIC category starts the clock. The examples below are selected duties, not a complete professional-practice retention standard.

Selected records to include in your retention schedule
Record category	Rule or decision to confirm	Useful evidence
Tax returns and supporting records	Generally five years from return submission. Unfiled required returns, audits, investigations, objections and appeals can change how long relevant records must remain available. Check SARS requirements for electronic form and authorisation before storing tax records outside South Africa. Sources: SARS retention policy; SARS Tax Administration guide.	Submission acknowledgements, record index, holds and location authorisations where required.
Company accounting and other statutory records	Required accounting records cover the current financial year and previous seven completed financial years. Other section 24 records have their own rules and triggers; seven years is not a universal deletion date for every company document. Sources: Companies Act, section 24.	Financial-year archive, record-category schedule and sample retrieval.
FIC records for activities in scope	Apply the relevant category: relationship records, transaction records and reports have different five-year minimum triggers. Keep them separate from a blanket engagement-closure rule and check longer holds. Sources: FIC PCC 6A; FIC Guidance Note 7B.	Activity assessment, relevant trigger dates and retrievable due-diligence records.

A backup retention setting is not a complete records policy. Record the owner, retention trigger, access rules, storage location, legal holds and authorised disposal for each category. Test retrieval, including the application or licence needed to read it. POPIA section 14 requires a lawful reason for continued retention; avoid keeping personal information indefinitely by default.

From risks to working controls

Protect access between clients and within the practice.

These are practical measures to assess against your environment and agreed service scope. Evidence should show what was checked, when, by whom and what still needs attention.

One client can see another client's records

Review client-folder permissions, sharing links and portal access. Use named accounts, suitable multi-factor authentication and access limited to the engagement team.

Possible evidence: Permission review, sharing exceptions and a sample client-access check.

An accounting database will not restore

Use the application's supported backup method and include dependencies, exports and licences in the recovery plan. Test a representative client database and document what was actually recoverable.

Possible evidence: Coverage list, backup exceptions and a restore result checked by the application owner.

Payroll or banking changes are fraudulent

Use independently known contacts to verify payment-detail changes. Separate preparation and approval where the practice's arrangements require it; restrict edits to master data.

Possible evidence: Verification records, approval trail and access review.

A former staff member retains tax or client access

Maintain a named-user register for accounting platforms, client portals and authorised tax-system access. Revoke permissions on departure and transfer required business records through approved procedures.

Possible evidence: Joiner/leaver checklist and confirmation of account and delegated-access changes.

A client leaves without usable records

Agree a secure handover method, file formats, custody and any continuing retention duties. Test exported records for readability and remove access when it is no longer justified.

Possible evidence: Acknowledged handover, export check and retained-record decision.

The control examples draw on NIST CSF 2.0 and banking-detail fraud guidance. Technical guidance is not itself South African legislation or a compliance certificate.

What to check

Professional duties depend on the work undertaken.

A bookkeeping engagement is not a statutory audit, and a technical backup report is not audit evidence that the accounts are correct. Registered auditors, tax practitioners and professional-body members can have additional duties that must be assessed under their own rules.

Confirm the authorised work, filing responsibilities and client approvals in the engagement. An MSP should support the agreed systems and controls without taking accounting, tax, audit or client-risk decisions.

Prepare before an incident

Identify affected clients and the practice's role.

Use the access and client registers to establish which records may be affected. Where the practice acts as an operator, escalate immediately to the responsible party under POPIA. Assess separately any processing for which the practice is itself the responsible party; do not assume that one client will handle every notification.

Under POPIA section 22, reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the Act's provisions. An operator must notify the responsible party immediately under section 21(2). There is no general 72-hour POPIA deadline. Sources: POPIA; Regulator guidance.

Agree who assesses the facts, preserves relevant evidence, makes notifications and authorises recovery. A technical incident report supports those decisions; it does not replace them.

Bastion Backups' role

Support the records your practice must retrieve.

Subject to an agreed scope, Bastion provides managed backup, recovery planning and testing, security checks and reporting, and controlled remote support. Start with your systems, record locations, authorised users and recovery priorities.

We can discuss supported accounting and payroll workloads, client-document repositories, access checks and restore testing. Coverage of hosted practice-management and tax platforms depends on available supplier-supported backup or export options.

Agree coverage, exclusions, responsibilities, storage and supplier arrangements, reporting, testing, support availability and any costs in writing before work begins. Where we process personal information as an operator, the written arrangement must address the applicable POPIA duties.

The practice and its clients retain their respective accounting, tax, professional, FIC and regulatory responsibilities. We do not certify regulatory compliance, promise that incidents will be prevented or guarantee recovery times without a specific agreed commitment.

Explore our supported solutions

Common questions

Decisions to make before selecting a service.

Must every accountant or bookkeeper register with the FIC?

Do not decide from the job title alone. Assess services against Schedule 1 and current FIC guidance. PCC 6A explains activity-based trust and company service provider scope, including relevant accounting practices. Other Schedule 1 activities may also need assessment.

Does the client's cloud accounting subscription cover our recovery needs?

Check the supplier's actual retention, restore and export options. Availability of the platform is different from recovering a particular client's deleted or altered information. Agree who holds usable copies, how access survives staff changes and what a test restore demonstrates.

Legislation and guidance

Check the source and its scope.

Content reviewed 16 October 2026.

SARS: taxpayer record retention authorisation policy — sections 29–30 of the Tax Administration Act, electronic records and authorisation for records kept outside South Africa.
SARS: Short Guide to the Tax Administration Act — recordkeeping and the effect of audits, investigations, objections and appeals. Read with current legislation.
Companies Act 71 of 2008 — Department of Justice text — section 24 distinguishes general company records from specified records and their retention triggers; accounting records cover the current and previous seven completed financial years.
FIC PCC 6A: trust and company service providers — paragraphs 3.1–3.3 explain activity-based application, including accounting practices.
FIC Guidance Note 7B — issued 3 August 2026; customer due diligence, recordkeeping and risk management and compliance programmes for accountable institutions.
Protection of Personal Information Act 4 of 2013 — sections 14, 19–22, 26–33 and 72: retention, safeguards, operators, incidents, special personal information and cross-border transfers.
Information Regulator: handling security compromises — notification roles and reporting process; read with POPIA sections 21 and 22.
NIST Cybersecurity Framework 2.0 — voluntary guidance for risk management, access, protection, recovery and evidence; not South African legislation.
Standard Bank: change-of-banking-details scams — independent verification of changed payment instructions using contact details already known.

Check current legislation, regulator notices and your own contracts before acting. The practical examples describe matters to review; they are not a statement that every listed control is legally required for every business.

View all industry guides

Discuss your practice systems

Start with client records, access and recovery.

Tell us which systems you use and what you need to review. Please do not send client files, identity documents, sensitive system configurations, passwords or access codes with an initial enquiry.

Email us Call +27 83 651 6444