Building a Records Retention Schedule (with Kenya Templates)
A retention schedule tells your system what to keep, for how long, and what to do at the end. Here's how to build one with Kenya-specific templates.
Building a Records Retention Schedule (with Kenya Templates)
A retention schedule is the spine of records management. Without one, every retention decision is made ad-hoc — and ad-hoc decisions don't survive audit scrutiny.
What's in a retention schedule
For each record series (document type or class), you specify:
- Trigger event: what starts the retention clock (creation date, end of fiscal year, end of contract, employee termination)
- Retention period: how long to keep it
- Disposition action: what to do at the end (delete, archive permanently, transfer to public archives)
- Legal authority: the law or regulation that justifies the period
- Review cycle: how often the schedule itself is reviewed (typically annual)
Kenya-specific retention baseline
The minimums below are derived from current Kenyan law. Always check current versions — some periods are sector-specific.
Tax and statutory financial
| Record | Trigger | Min Retention | Authority |
|---|---|---|---|
| Tax invoices issued/received | Date of issue | 5 years | Tax Procedures Act §23 |
| VAT returns and supporting docs | End of tax year | 5 years | VAT Act |
| KRA correspondence | Date of receipt | 5 years | KRA practice |
| Annual financial statements | End of fiscal year | 7 years | Companies Act |
Employment and HR
| Record | Trigger | Min Retention | Authority |
|---|---|---|---|
| Employment contracts | Termination | 7 years | Employment Act practice |
| Payroll records | End of pay period | 6 years | Employment Act §74 |
| NSSF records | Date created | 6 years | NSSF Act |
| Disciplinary records | Termination | 6 years | Employment Act |
| Personnel files (general) | Termination | 7 years | Employment Act practice |
Contracts and commercial
| Record | Trigger | Min Retention | Authority |
|---|---|---|---|
| Contracts (general commercial) | Contract expiry | 6 years | Limitation of Actions Act |
| Deeds and instruments under seal | Document date | 12 years | Limitation of Actions Act |
| Tender documents | Award decision | 6 years | PPRA |
| Purchase orders | Document date | 6 years | Limitation of Actions Act |
Corporate governance
| Record | Trigger | Min Retention | Authority |
|---|---|---|---|
| Board minutes | Date of meeting | Permanent | Companies Act |
| Resolutions | Date passed | Permanent | Companies Act |
| Registers (members, directors, charges) | Date of entry | Permanent | Companies Act |
| Annual returns | Submission date | 7 years | Companies Act |
Customer / counterparty
| Record | Trigger | Min Retention | Authority |
|---|---|---|---|
| Customer KYC | Account closure | 7 years | POCAMLA (AML) |
| Account transactions | Transaction date | 7 years | POCAMLA |
| Customer correspondence (general) | Communication date | 3 years | Practice |
| Complaints and resolution | Resolution date | 6 years | Sector regulators (CBK, IRA, EPRA) |
Sector-specific (selected)
| Record | Trigger | Min Retention | Authority |
|---|---|---|---|
| Patient records (medical) | Last visit | 25 years (general), longer for minors | KMPDC |
| Patient consent forms | Date of consent | Same as patient record | DPA + KMPDC |
| Bank loan files | Loan closure | 7 years | CBK Prudential Guidelines |
| Insurance policy files | Policy termination | 7 years | IRA |
| Educational records (student) | Graduation/exit | Permanent | Universities Act / Education Act |
The schedule as code
In Papyrus, the schedule is a configuration object, not a binder. Each RetentionPolicy includes:
- classification: "Tax Invoice"
trigger: "DocumentDate + EndOfYear"
retentionYears: 5
dispositionAction: "ReviewForDeletion"
reviewCycle: "Annual"
legalAuthority: "Tax Procedures Act §23"
overrideForLitigationHold: true
When the trigger fires (e.g., 5 years after the end of the tax year a document falls in), the document enters the disposition queue. A Records Officer reviews; documents under litigation hold are flagged and skipped; the rest are dispositioned per the policy action.
How to actually build it
Week 1 — Inventory
Run a Papyrus query for every document classification active in the last 18 months. For each, identify:
- What law/practice governs it?
- What's the minimum retention?
- What's the disposition action?
If you have 25-40 classifications, this takes 1-2 weeks of a Records Officer's time.
Week 2 — Validate with stakeholders
Walk each schedule entry past:
- Legal Counsel (for legal authority)
- Finance (for tax records)
- HR (for employee records)
- The relevant Department Head
Don't skip this. The Records Officer cannot single-handedly set retention for every department.
Week 3 — Implement in Papyrus
Translate the validated schedule into RetentionPolicy configurations. Test with a small batch first.
Week 4 — Review and ratify
Present to the Compliance Committee (or equivalent). Get formal ratification. Schedule the first annual review.
What auditors look for
- A written, ratified schedule covering every active record class
- Evidence the schedule is applied (not just on paper)
- Evidence of periodic review (the schedule itself has a review date)
- Justification for any record kept beyond its retention period