POPIA and Your CRM: How Long Should You Keep Customer Records?

Keep personal information in your CRM only for as long as you have a lawful, justified reason to retain it. POPIA does not set one expiry date for every customer record: the right period depends on the purpose, applicable record-keeping requirements and any properly documented exceptions.

The practical answer to a POPIA data retention CRM question is therefore a retention schedule, not a blanket instruction to delete everything after a fixed number of years. This is general operational guidance, not legal advice. Have your Information Officer and relevant advisers confirm the requirements for your organisation.

1. Separate the customer profile from the records attached to it

A CRM customer profile can contain several different record types. Contact details, quotes, VAT invoices, service tickets, call recordings and identity documents do not necessarily need the same retention period.

Consider a Johannesburg maintenance business whose customer stops using its services. Finance may still need transaction records, while sales no longer needs an old contact list or speculative notes about future work. Keeping the invoice does not automatically justify keeping every attachment and conversation.

Start by asking four questions about each record category:

• Purpose: Why did we collect this information, and does that purpose still apply?
• Requirement: Does a law, contract or approved records schedule require retention?
• Trigger: Which event starts the retention period?
• Outcome: Should the record be deleted, destroyed or properly de-identified when the period ends?

For brokers, FAIS and FICA obligations may affect particular records. For public entities and SETAs, public-sector records management and disposal requirements also matter. Confirm these separately rather than applying an SME sales database policy to every organisation.

Our guide to FAIS record-keeping for South African brokers provides related context for advice and service records.

2. Build a retention schedule with clear starting points

A useful schedule states what to keep, why, for how long, who owns the decision and what happens afterwards. Avoid vague instructions such as “retain while useful”. They give busy teams permission to keep everything.

The table below is a starting framework, not a list of statutory deadlines. Populate the actual periods after checking your obligations.

For example, a business might choose to review unsuccessful enquiries six months after closure. That is an illustrative internal review point, not a POPIA deadline or automatic permission to retain every enquiry for six months.

Define “meaningful engagement” carefully. An automated newsletter or an internal note should not restart the clock indefinitely. Similarly, a new purchase should not silently extend the life of unrelated documents from an old transaction.

Record who approved each rule and when it must be reviewed. This helps when contracts, business activities or applicable requirements change.

3. Turn the schedule into a controlled monthly routine

Retention fails when it exists only in a policy document. Give someone responsibility for producing a review list and someone else authority to approve exceptions or disposal.

1. Identify candidates. Find records reaching their review date, including dormant customers and closed enquiries.
2. Check dependencies. Confirm whether linked invoices, projects, tickets or complaints still need the information.
3. Check holds. Flag relevant litigation, investigations, disputes or other justified preservation needs before disposal.
4. Approve the action. Record the applicable rule and decision without copying unnecessary personal information into the approval log.
5. Complete and verify. Check the outcome across the CRM and connected locations.

A preservation hold should identify its reason, scope, owner and next review date. “We might need it one day” is not a useful hold. Preserve the relevant records, not automatically the customer's entire history.

Keep a limited disposal log showing the record category, action date, authorisation and outcome. Set a retention rule for that log too. Otherwise, the evidence of deletion can become another permanent store of personal information.

This routine belongs alongside access control, lawful processing and incident response. See the broader POPIA compliance checklist for South African businesses for those connected controls.

4. Handle deletion, archives and copies properly

Moving a record into an archive does not end retention. It is still held by the organisation and still needs a justified purpose, suitable protection and an eventual disposal decision.

Likewise, removing a name does not necessarily de-identify a record. An email address, policy number, detailed ticket description or combination of fields may still identify someone. If you keep historical reporting, assess whether the remaining information can reasonably be linked back to a person.

Check places where CRM data commonly spreads:

• Spreadsheet exports, shared drives and staff downloads.
• Email attachments and documents uploaded through a client portal.
• Connected accounting, marketing and phone systems.
• Supplier-held copies, backups and recovery environments.

Backups need a documented expiry and recovery approach. If individual deletion from a backup is not practical, confirm appropriate restrictions and ensure restoration does not quietly return previously deleted records to normal use. Ask suppliers how deletion, backup rotation and restored data are handled.

Opt-outs also need care. Removing someone from marketing should stop the marketing activity. Where justified, a minimal suppression record can help prevent accidental re-importing, but it should not become an excuse to retain the entire sales profile.

5. How Recenvy supports the retention workflow

Recenvy's CRM (Customers) sits within a business operating system covering sales, quotes, VAT invoicing, helpdesk, projects and reporting. This gives teams a connected working context for distinguishing an active customer relationship from an old sales enquiry or a completed service matter.

Your organisation must still define its retention rules and approve disposal decisions. Software does not decide whether a financial record, broker document or stakeholder enquiry must legally be retained.

When assessing Recenvy, bring sample records and your proposed schedule. Ask the team to demonstrate how review dates, permissions, linked records, exports and disposal requirements would be handled. Confirm deletion, de-identification, audit evidence and backup behaviour explicitly rather than assuming these follow automatically from having a CRM.

Frequently asked questions

Does POPIA require us to delete CRM records after five years?

No single five-year rule applies to every CRM record. Determine the period by record category, purpose and applicable obligations. A financial record and an abandoned sales enquiry may need different treatment.

Must we delete everything when a customer asks?

Not automatically. Verify the request and assess it promptly. Some records may still need to be retained lawfully. Explain the outcome and any justified limits, while removing information that no longer has a valid retention basis.

Can we keep dormant leads for future marketing?

Possible future interest is not enough on its own. Assess both the justification for retention and the rules governing the proposed marketing activity. A stored email address does not automatically authorise another campaign.

Who should own CRM retention?

The Information Officer should guide governance, with input from legal, finance and operational owners. Assign a named person to run reviews and an authorised decision-maker to approve exceptions and disposal.

Start with one record category, agree its purpose and retention trigger, then test the review process before expanding it. If you want to see how a connected customer workflow could support that approach, book a demo.