Choosing and implementing business systems — accounting, payroll, point of sale, customer management, inventory or an integrated ERP — is one of the more consequential decisions a growing South African business makes, and it carries regulatory requirements most vendors do not raise.
The systems you choose must not only do the work; they must support the records South African law requires you to keep, in the form and for the periods prescribed. That is a requirement, not a preference.
Business Requirements at a Glance
What a business system must support to satisfy South African obligations.
- Accounting records in the form and for the retention period the Companies Act and the Tax Administration Act require
- Tax records capable of supporting SARS returns and surviving an audit, including VAT input and output records
- Payroll records supporting PAYE, UIF, SDL and the employer reconciliation
- Employment records required by the Basic Conditions of Employment Act, including hours worked and leave
- Personal information handled in accordance with the Protection of Personal Information Act
- Sector-specific records where you are regulated — FAIS, the National Credit Act, FICA and others
- Reliable backup and recovery, since the obligation to produce records survives a system failure
Registration and Legal Requirements
POPIA is the requirement most often overlooked at selection. Any system holding customer or employee data engages it: lawful basis for processing, purpose limitation, retention limits, access controls, security safeguards and the ability to respond to a data subject request or delete data when required.
Ask a vendor directly whether the system supports data subject access requests, deletion, retention rules and access logging. Many do not, and retrofitting compliance is expensive.
Data residency deserves a specific question. POPIA restricts transfers of personal information outside South Africa in defined circumstances. Cloud systems frequently store data offshore, and while that is not automatically prohibited, it must be addressed. Ask where the data is stored and what contractual protections apply.
SARS record-keeping is prescriptive. Records must be kept for the prescribed retention period, must be capable of being produced in a readable form, and electronic records must be retrievable. A system that cannot export historical data, or a subscription that locks data behind a lapsed licence, creates a genuine problem.
Ask what happens to your data if you stop paying. Systems that hold data hostage on cancellation are common and the answer should be established before you commit.
Payroll deserves particular care because errors compound. It must handle PAYE, UIF, SDL, the annual reconciliation, any bargaining council or provident fund contributions and the employment records the BCEA requires. Generic international payroll systems frequently do not handle South African statutory requirements correctly.
Documents and Ownership Information Required
What to establish before selecting a system.
- An inventory of the records you are legally required to keep, and for how long
- Your current processes, documented, so you know what the system must support
- Volumes: transactions, users, employees, customers, growth expectations
- Integration requirements with existing systems and with your bank
- Sector regulatory requirements applying to your records
- A data migration plan for historical records
- A written statement from the vendor on data location, ownership and export on termination
- Vendor references from South African businesses of similar size and sector
- Total cost including licences, implementation, training, support and future users
Tax, Licence and Compliance Requirements
Implementation is where systems projects fail, not selection. Budget for data migration, configuration, training and a period of running in parallel. The licence cost is usually the smaller part, and businesses that budget only for it run out of money mid-implementation.
Buy South African-aware software for statutory functions. Accounting and payroll systems built for other jurisdictions frequently handle VAT, PAYE and the SARS reconciliation incorrectly or not at all. For those functions specifically, local capability matters more than feature lists.
Access control is a compliance requirement, not an IT preference. Who can see payroll, who can authorise payments, who can amend records and whether changes are logged all matter for POPIA, for fraud prevention and for audit. Segregation of duties in a small business is difficult but not optional.
Backups must be tested. An untested backup is an assumption. Test a restore, because the obligation to produce records is not excused by a system failure, and ransomware attacks on South African small businesses are common.
Consumer-facing systems engage more law. The Consumer Protection Act and the Electronic Communications and Transactions Act govern what an online system must disclose and how electronic transactions are concluded. Build that in rather than adding it later.
Keep the vendor contract sensible. Know the notice period, the price escalation, what support is included, what happens on termination and who owns customisations. These are negotiable before signature and not afterwards.
Process, Deadlines and Ongoing Obligations
Document what you need before speaking to vendors. Businesses that start with a demonstration end up buying what was demonstrated rather than what they need.
Then check the statutory functions specifically — VAT, PAYE, record retention, POPIA and any sector requirements — and take references from South African businesses in your sector before committing.
- List the records you must keep by law, and for how long, before selecting
- Ask vendors specifically about POPIA support and data residency
- Establish what happens to your data on termination or non-payment
- Use South African-aware software for accounting and payroll specifically
- Budget for implementation, migration and training, not just licences
- Configure access controls and change logging from the start
- Test a backup restore rather than assuming backups work
- Take references from South African businesses in your sector
- Negotiate notice, escalation and data ownership before signing
Frequently Asked Questions
Does my accounting system need to be South African?
For statutory functions like VAT and PAYE, local capability matters considerably. Systems built for other jurisdictions frequently handle South African requirements incorrectly.
What does POPIA require of my systems?
A lawful basis for processing, purpose and retention limits, access controls, security safeguards, and the ability to respond to data subject requests and delete data. Ask vendors directly whether the system supports these.
Can my data be stored offshore?
POPIA restricts transfers outside South Africa in defined circumstances. It is not automatically prohibited but must be addressed. Ask where data is stored and what contractual protections apply.
What happens to my data if I stop paying?
Establish this before committing. Systems that lock data behind a lapsed licence create a real problem, because your obligation to produce records to SARS survives the subscription.
Record-keeping obligations, retention periods and data protection requirements are set under the Companies Act, the Tax Administration Act, POPIA and sector legislation, and are amended. Confirm current requirements with SARS, the Information Regulator and your sector regulator.