Assessment, governance & sustainability
Records retention schedule and disposal policy, grounded in Kenyan law
A written, legally grounded schedule that says what to keep, for how long, and how to dispose of it.
A retention schedule tells your staff what to keep, for how long, and what to do with it afterwards. Ours are written for Kenyan organisations and cite the law behind every period. A decision to keep or destroy a record can then be defended to an auditor, a regulator or a court.
The policy and the schedule work together. The policy sets the rules and who is responsible. The schedule lists each type of record with its retention period, its legal source and its disposal action.
Who it is for
Organisations whose store rooms are full of files nobody dares to throw away. SACCOs that must keep member and loan records for the periods SASRA and tax law require. NGOs balancing donor retention clauses with Kenyan law. Government entities working under PPADA 2015. Any organisation that holds personal data, because the Data Protection Act 2019 says it should not be kept longer than needed.
The problem it solves
Without a schedule, organisations either keep everything or destroy records informally. Keeping everything costs space and money, and breaks the storage-limitation principle for personal data. Informal destruction can leave you unable to answer a KRA query or an audit. Both are risks. A written schedule replaces individual judgement with an approved rule.
How we do it, step by step
Inventory of record types
We list the records each department creates, often starting from a records audit if you have one.
Legal research
For each type we identify the binding requirement: the Tax Procedures Act and KRA record keeping rules, PPADA 2015, SASRA regulations, employment law, donor agreements and the Data Protection Act 2019.
Draft schedule
Retention periods, trigger events (such as the end of a financial year or the closure of a loan) and disposal actions are set out record by record, with the citation.
Review with your team
Heads of department check the draft against how they actually work, and we resolve any conflicts between rules.
Disposal procedure
We write the approval route for destruction, so no record is destroyed without authorisation and a note of what was destroyed.
Approval and handover
The policy goes to your management or board for approval, and we brief the people who will apply it.
KRA record keeping and the Data Protection Act 2019
Two sets of rules pull in different directions. Tax law requires financial records to be kept for a set period and produced on request. The Data Protection Act 2019 requires personal data to be kept no longer than necessary. A good schedule satisfies both. It keeps what the law requires for exactly as long as required, then disposes of it in a controlled way.
Secure disposal
When records reach the end of their retention period and disposal is approved, they are shredded securely and the paper is recycled. A certificate of destruction records what was destroyed, when and on whose authority. Records that must be kept permanently are identified for digitisation or transfer to an archive.
What you receive
- Written records retention and disposal policy
- Document-by-document retention schedule with legal citation
- Approved disposal procedure and authorisation workflow
- Certificate of destruction template
Timelines and cost
Most policies take two to four days of work, spread over enough time for your team to review the draft. Approval then follows your own board or management cycle. Fees are scoped per engagement, and you receive a written proposal within 48 hours.
Frequently asked questions
- Is there one retention period for all records in Kenya?
- No. Periods depend on the type of record and the law or agreement that applies to it. That is why the schedule cites the source for each line.
- Can we destroy records once they are scanned?
- Sometimes. It depends on the record and on whether the law or a regulator requires the original. The schedule says which originals must be kept.
- Does the policy cover electronic records?
- Yes. The same periods apply to email, shared drives and systems, and we explain how to apply them in an EDMS.
- Who approves disposal?
- The policy names the approvers, usually the head of the department and the records officer, and every approval is recorded.
Related services
Records Audit & Assessment
A systematic review of your records environment, ending in a costed action plan.
Compliance & Audit Support
Specialist support through Auditor-General, donor, regulator and internal audit cycles.
Paperless & Sustainability Advisory
A measured route to paperless operations, with the evidence to report progress.
Sectors this service is built for: Government entities, SACCOs, NGOs, Law firms.
Related insights
Start with a conversation.
Tell us what your records look like today. We will meet you on site, listen, and send a written proposal within 48 hours.