South African logistics and distribution
Dispatch, warehouse and delivery records need to stay available and accurate. Drivers, customers, depots and service providers share information throughout a shipment; the controls should follow it from booking to proof of delivery.
The regulatory context
A warehouse operator, road carrier, freight forwarder and customs client have different obligations. This guide does not treat them as one regulated activity.
POPIA
Customer addresses, contact details, signatures and identifiable driver-location data can be personal information. Establish the purpose, appropriate access and retention, and assess operators and cross-border transfers.
Review what is shared with subcontracted carriers, tracking platforms and customers. A tracking link should not reveal another customer's deliveries or unnecessary driver information.
Sources: POPIA.
Road transport and operations
The National Road Traffic Act and applicable regulations govern road traffic matters. Confirm the vehicle, driver, operator and load requirements for the service performed. Warehouse and workplace safety need their own assessment.
IT can help retrieve documents and control expiry reminders. It does not establish roadworthiness, driver fitness, correct loading or permission to carry a particular load.
Sources: National Road Traffic Act; OHS Act.
Customs and tax records
Import, export and customs activities can introduce recordkeeping and location requirements under the Customs and Excise Act. These are separate from normal tax and company records.
Identify the party responsible for the records, the applicable retention trigger and whether electronic storage or an overseas location needs authorisation.
Sources: SARS customs record guide; SARS retention policy.
This guide covers selected information and IT matters. It is not a complete legal checklist or a finding that your organisation complies. Confirm applicability with the people responsible for your legal, regulatory and operational duties. See the general Compliance page for the wider context, including PAIA.
Keep what is required, for the right reason
Treat customer contracts, customs records and personal data as separate categories. A proof-of-delivery retention period is not automatically the rule for the whole business.
| Record category | Rule or decision to confirm | Useful evidence |
|---|---|---|
| Imported and exported goods | SARS describes a general minimum of five years from importation or exportation. Customs-warehouse and rebate-store records have different triggers. Records must be kept at the business premises in the Republic unless the Controller authorises otherwise; confirm permitted electronic storage arrangements. Sources: SARS customs record guide. | Shipment index, clearance documents, applicable authorisations and retrieval tests. |
| Proof of delivery, tracking and customer correspondence | Determine retention from the purpose, contract, relevant laws and claims or disputes. Identify whether a delivery record also supports tax or customs obligations. Retain identifiable tracking information only for justified purposes. Sources: POPIA; SARS retention policy; SARS customs record guide. | Shipment-to-document linkage, access history and a category-specific schedule. |
| Tax and company accounting records | Tax records generally run for five years from submission of the relevant return, with exceptions and longer holds. Required company accounting records cover the current and previous seven completed financial years. Sources: SARS retention policy; SARS Tax Administration guide; Companies Act, section 24. | Return-date and financial-year schedule, holds and restore results. |
A backup retention setting is not a complete records policy. Record the owner, retention trigger, access rules, storage location, legal holds and authorised disposal for each category. Test retrieval, including the application or licence needed to read it. POPIA section 14 requires a lawful reason for continued retention; avoid keeping personal information indefinitely by default.
From risks to working controls
These are practical measures to assess against your environment and agreed service scope. Evidence should show what was checked, when, by whom and what still needs attention.
Map booking, stock, dispatch, labels and proof-of-delivery dependencies. Confirm supplier-supported backups and exports. Test recovery of representative records and agree the approved manual fallback and later reconciliation.
Possible evidence: Dependency map, tested restore, fallback procedure and reconciliation results.
Use individual accounts, suitable device protection and a clear loss-reporting process. Limit stored delivery information and agree how authorised access is revoked.
Possible evidence: Device and user register, configuration checks and revocation records.
Assign access for the relevant work only. Review shared links, subcontractor accounts and tracking-platform access when a contract ends or a user leaves.
Possible evidence: Partner-access review and completed closure checklist.
Keep shipment identifiers, controlled corrections and an audit trail in the approved repository. Check that scans and signatures remain readable after export or restoration.
Possible evidence: Document history, corrected-record approvals and sample retrieval results.
Verify changed bank details through a known independent contact. Set approval rules for changes to collection and delivery instructions; do not rely on a forwarded email alone.
Possible evidence: Verification procedure, approval records and exception reports.
The control examples draw on NIST CSF 2.0 and banking-detail fraud guidance. Technical guidance is not itself South African legislation or a compliance certificate.
What to check
A transport or warehouse platform may be supplied as a hosted service. Establish what the supplier backs up, what your organisation can export, which logs are available and how records can be recovered if access to the service is lost.
Cross-border transport, dangerous goods, food, medicines and other specialised loads can bring additional duties. The responsible transport or sector specialist must determine those requirements. This guide does not promise a complete transport-compliance assessment.
Prepare before an incident
Record the affected depots, shipments, systems and information before choosing containment and recovery steps. Use the approved operational fallback where available. Limit disclosure of routes and customer details while keeping the responsible operations team informed.
Under POPIA section 22, reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the Act's provisions. An operator must notify the responsible party immediately under section 21(2). There is no general 72-hour POPIA deadline. Sources: POPIA; Regulator guidance.
Agree who assesses the facts, preserves relevant evidence, makes notifications and authorises recovery. A technical incident report supports those decisions; it does not replace them.
Bastion Backups' role
Subject to an agreed scope, Bastion provides managed backup, recovery planning and testing, security checks and reporting, and controlled remote support. Start with your systems, record locations, authorised users and recovery priorities.
We can discuss dispatch and office data, agreed warehouse-system workloads, device access and recovery tests. Hosted tracking, scanning and transport platforms need confirmed supplier support and recovery options before coverage is agreed.
Agree coverage, exclusions, responsibilities, storage and supplier arrangements, reporting, testing, support availability and any costs in writing before work begins. Where we process personal information as an operator, the written arrangement must address the applicable POPIA duties.
The business retains transport, warehouse, customs, customer-notification and regulatory responsibilities. We do not certify regulatory compliance, promise that incidents will be prevented or guarantee recovery times without a specific agreed commitment.
Explore our supported solutionsCommon questions
There is no single rule for all delivery data. A record may support a contract, claim, tax return or customs entry, each with different requirements and triggers. Identify the applicable duties and justified purpose before setting retention.
Check the record type first. POPIA section 72 addresses personal-information transfers, while customs and tax recordkeeping can introduce separate location or authorisation requirements. Do not choose a region based only on a generic POPIA statement.
Legislation and guidance
Content reviewed 16 October 2026.
Check current legislation, regulator notices and your own contracts before acting. The practical examples describe matters to review; they are not a statement that every listed control is legally required for every business.
View all industry guidesDiscuss your logistics systems
Tell us which systems you use and what you need to review. Please do not send client files, identity documents, sensitive system configurations, passwords or access codes with an initial enquiry.