South African construction businesses
Site files, drawings, subcontractor records and payment instructions pass between people, offices and projects. Keep the required information accessible, control changes and plan how work will continue when a device or system fails.
The regulatory context
A client, principal contractor and subcontractor have different responsibilities. Establish your role on each project before deciding which records and controls you need.
OHS and construction duties
The OHS Act and Construction Regulations 2014 address construction safety responsibilities. Regulation 7 includes site health and safety files, access for specified parties and principal-contractor handover to the client on completion.
A backed-up folder supports availability. It does not prove that a safety file is complete, that an appointment is valid or that work is safe.
Sources: OHS Act; Construction Regulations 2014.
POPIA
Employee details, identity documents, payroll and medical fitness information need appropriate handling. POPIA sections 19–21 address safeguards and operators. Health information also needs assessment under the special-personal-information provisions.
Limit access to what each role needs. A subcontractor should not receive an entire workforce file merely because one document is required.
Sources: POPIA.
Tax and company records
SARS recordkeeping and Companies Act duties can apply alongside project contracts. A project's completion date is not the retention trigger for every invoice, payroll record or company document.
Identify tax, company, contractual and dispute requirements before setting archive or backup retention.
Sources: SARS retention policy; SARS Tax Administration guide; Companies Act, section 24.
This guide covers selected information and IT matters. It is not a complete legal checklist or a finding that your organisation complies. Confirm applicability with the people responsible for your legal, regulatory and operational duties. See the general Compliance page for the wider context, including PAIA.
Keep what is required, for the right reason
The following categories need separate decisions. There is no single retention period covering all construction files.
| Record category | Rule or decision to confirm | Useful evidence |
|---|---|---|
| Health and safety file | Regulation 7 requires the relevant site file and principal-contractor handover on completion. The client has duties under regulation 5. Confirm the required contents, on-site format and continuing custody with the responsible safety practitioner; do not assume a cloud copy replaces the required site file. Sources: Construction Regulations 2014. | File index, version history, availability checks and acknowledged handover. |
| Drawings, variations and project correspondence | Agree approved versions, project handover and retention with reference to the contract, applicable duties and claims or disputes. Do not apply an invented universal five-year rule. | Approved drawing register, change approvals and a retrievable archive. |
| Tax and company accounting records | Tax records generally run for five years from submission of the relevant return, with exceptions and longer holds. A company's required accounting records cover the current financial year and previous seven completed financial years. Sources: SARS retention policy; SARS Tax Administration guide; Companies Act, section 24. | Retention schedule linked to return dates and financial years; recorded holds. |
A backup retention setting is not a complete records policy. Record the owner, retention trigger, access rules, storage location, legal holds and authorised disposal for each category. Test retrieval, including the application or licence needed to read it. POPIA section 14 requires a lawful reason for continued retention; avoid keeping personal information indefinitely by default.
From risks to working controls
These are practical measures to assess against your environment and agreed service scope. Evidence should show what was checked, when, by whom and what still needs attention.
Use an approved drawing repository with revision identifiers, controlled publishing and access for the current project team. Separate working drafts from issued documents.
Possible evidence: Issued drawing register, approval trail and a sample retrieval check.
Review encryption, individual accounts, multi-factor authentication and local storage. Agree how loss is reported and access is revoked. Test whether site records reach the agreed backup while connectivity is intermittent.
Possible evidence: Device register, access settings, backup exceptions and a completed restore test.
Verify changes through a contact number already known, with a second approval where required by company policy. Restrict who can edit supplier bank details.
Possible evidence: Payment-change procedure, approval record and account-access review.
Review subcontractor and temporary-user access at handover. Move required records into the approved archive and remove access that is no longer justified.
Possible evidence: Project closure checklist, sharing review and archive retrieval results.
Document the records needed to work safely, the approved fallback and how changes are reconciled when systems return. Test recovery of the project repository and office systems in scope.
Possible evidence: Fallback procedure, dependency list and recovery exercise with outstanding actions.
The control examples draw on NIST CSF 2.0 and banking-detail fraud guidance. Technical guidance is not itself South African legislation or a compliance certificate.
What to check
The Department published proposed replacement Construction Regulations for comment in March 2025. The proposal includes electronic health and safety files. A consultation notice is not evidence that a new rule is in force; this guide relies on the published 2014 duties and identifies the proposal separately.
Agree the required file format and on-site availability with the project's safety practitioner and client. Keep a controlled digital copy for retrieval and recovery where appropriate, without removing originals or site records that must remain available.
Prepare before an incident
If a site system is compromised, involve the project and safety leads before taking steps that could interrupt safety-related information or operations. Preserve relevant access, email and document-change records. Use independently verified contacts when payment fraud is suspected.
Under POPIA section 22, reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the Act's provisions. An operator must notify the responsible party immediately under section 21(2). There is no general 72-hour POPIA deadline. Sources: POPIA; Regulator guidance.
Agree who assesses the facts, preserves relevant evidence, makes notifications and authorises recovery. A technical incident report supports those decisions; it does not replace them.
Bastion Backups' role
Subject to an agreed scope, Bastion provides managed backup, recovery planning and testing, security checks and reporting, and controlled remote support. Start with your systems, record locations, authorised users and recovery priorities.
We can discuss site-office and head-office data, agreed cloud workloads, project archives and restore testing. Specialist design systems and third-party platforms need confirmed access, licensing and supplier support before coverage is promised.
Agree coverage, exclusions, responsibilities, storage and supplier arrangements, reporting, testing, support availability and any costs in writing before work begins. Where we process personal information as an operator, the written arrangement must address the applicable POPIA duties.
Clients, contractors and their appointed practitioners retain their construction, safety, contractual and regulatory responsibilities. We do not certify regulatory compliance, promise that incidents will be prevented or guarantee recovery times without a specific agreed commitment.
Explore our supported solutionsCommon questions
Do not assume so. Check the applicable regulations, project requirements and accepted on-site format with the responsible practitioner. The 2025 proposal's reference to electronic files must not be treated as a commenced permission merely because the draft was published.
Only if the agreed scope includes the relevant data and a usable recovery method. Confirm application databases, linked files, cloud repositories, licences and dependencies, then test a representative project restore.
Legislation and guidance
Content reviewed 16 October 2026.
Check current legislation, regulator notices and your own contracts before acting. The practical examples describe matters to review; they are not a statement that every listed control is legally required for every business.
View all industry guidesDiscuss your project systems
Tell us which systems you use and what you need to review. Please do not send client files, identity documents, sensitive system configurations, passwords or access codes with an initial enquiry.