Purpose specification: say why you collect
“Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party.”
The purpose does double duty across the Act: it measures minimality (adequate, relevant, not excessive for the purpose), it anchors the compatibility test for further processing, and it starts the retention clock. A purpose you never defined is a purpose you cannot measure anything against — which is why mapping purposes is step one of the compliance shortlist.
The retention rule — and its four exceptions
“records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed”
Note — The four exceptions that follow immediately in s 14(1)(a)–(d): retention required or authorised by law; reasonably required “for lawful purposes related to its functions or activities”; required by a contract between the parties; or the data subject (or competent person, for a child) has consented.
The exceptions carry ordinary commercial reality. Companies Act and Tax Administration Act retention periods are retention “required or authorised by law”. Keeping evidence for the prescription period of potential claims is retention “reasonably required for lawful purposes related to your functions”. The rule POPIA actually adds is the discipline: retention must be a decision per record type, not an accident of never cleaning up.
Building a retention schedule
A workable schedule has three columns: the record type, the period with its justification (the statute requiring it, the contract, or the prescription analysis), and what happens at expiry (delete or de-identify). Common anchors in South African practice include company records under the Companies Act, tax records under the Tax Administration Act, employment records under the BCEA, FICA records for accountable institutions, and the prescription period for contractual and delictual claims. The specific periods for your records are a legal judgment on your facts — the schedule structure is the compliance work POPIA expects to see.
At the end: delete or de-identify — actually
When a retention period expires, section 14 expects the record to be destroyed, deleted or de-identified. De-identification must be real: stripped of anything that identifies, can identify or can be linked to a person by any reasonably foreseeable method — at which point POPIA no longer applies to it and analytics can keep the history. The operational failure mode is keeping everything forever “just in case”: it inflates breach exposure (every stale record is one more record to notify about), and it turns every access request into an archaeology project.