Data and Records Management Training: What Staff Need to Know

A records management course teaches staff to control a record from the day it is created to the day it is destroyed. That covers filing and naming, version control, who may see what, how long each record must be kept, how POPIA applies to personal information, and how to dispose of records securely. This guide sets out what that training covers and what your team should come away able to do.

See all BOTI leadership and management courses.

If you are comparing records management courses in South Africa, or data management courses in South Africa more broadly, start with the basics below. The same topics run through BOTI’s two-day course.

What a records management course covers

Records are the evidence of what your organisation did, decided and agreed. If records are poorly managed, people cannot find documents, work from outdated versions, keep personal information too long or destroy something they were legally required to keep. Records management forms part of governance, risk and compliance, and it reduces the risk that comes with holding that evidence.

BOTI’s Mastering Data and Records Management course runs over two days. It covers these practical areas:

• Building a data management system and carrying out a data management assessment
• Setting up a data classification and referencing system
• Filing systems, both paper and electronic
• Controlling access to data and applying security measures
• The rules on data retention and disposal
• Handling confidential documents and information discreetly
• Policies, procedures and control measures, and how they link to a quality management system
• The role of information systems, including using Microsoft Outlook to manage information

The course is instructor-led, with strong delegate participation and practical exercises, so delegates can apply the methods to their own records.

The records life cycle: create, use, store, retain, dispose

Every archive and records management system follows the same life cycle. Staff who understand each stage make better decisions without having to ask each time.

Create

A record starts when a document, email, form, spreadsheet or file note captures a business activity. At this stage it should be given a clear name, a reference number and a place in the classification system. A record that is badly named when it is created is hard to find later.

Use

While a record is active, people read it, update it and share it. This is where version control and access rights matter most. The question at this stage is always whether the people working with the record are using the current version and whether they are allowed to see it.

Store

Active records sit where the people who use them can reach them. Inactive records move to an archive, either a records room or a controlled electronic location. Storage should protect records from loss, damage and unauthorised access, and should still allow them to be retrieved and tracked.

Retain

Each type of record has a retention period, which is the time it must be kept before it may be destroyed. A retention schedule lists record types, their retention periods and who is responsible for them.

Dispose

When the retention period ends, and nothing such as an audit, dispute or investigation requires the record to be kept, it is destroyed securely or transferred to a permanent archive. The disposal itself should be recorded.

Filing, naming and version control

Most day-to-day records problems come from inconsistent filing. A short set of rules that everyone follows works better than a complex system that nobody uses.

• Classification: group records by function or activity (for example, finance, human resources, contracts, projects) rather than by the person who created them.
• Referencing: give each file or folder a reference number from the classification system, so it can be found and cross-referenced.
• Naming conventions: agree on a pattern, for example date, subject and document type, and use it on every file. Avoid names such as “final”, “new” or “latest”.
• Version control: number versions, keep one master copy in one agreed location, and mark drafts clearly. When a document is approved, record who approved it and when.
• One source of truth: do not keep personal copies on desktops, personal devices or private email, where they cannot be controlled or found.

Access, security and confidentiality

Not every staff member needs to see every record. Access should follow the role. HR files, disciplinary records, payroll, medical information and client data need tighter control than general correspondence.

Practical control measures include:

• Access rights on shared drives and systems, reviewed when people change roles or leave
• Locked storage and a sign-out register for confidential paper files
• Clear desk and clear screen habits
• Care when emailing or printing confidential information
• Reporting lost files or suspected breaches immediately

Confidentiality also depends on behaviour. Staff who handle sensitive records need to know when to be discreet and whom to ask when they are unsure.

Retention periods: how long to keep records

There is no single retention period for all records in South Africa. Different laws apply to different records. Two common examples:

• Companies Act: company records are kept for 7 years.
• Tax Administration Act: tax records are kept for 5 years from the date the return was submitted.

For any other record, check the law that applies to that record and take advice where you are unsure. Build the answer into your retention schedule so that staff do not have to decide one file at a time.

POPIA and personal information in your records

The Protection of Personal Information Act 4 of 2013 (POPIA) has been fully in force since 1 July 2021. It applies whenever your records contain personal information about employees, clients, suppliers or members of the public, which describes most records.

For records management, POPIA means three things in practice:

• Know what personal information you hold, where it is and why you hold it.
• Protect it with sensible security and access controls.
• Do not keep it longer than the purpose requires, unless a law requires you to keep it.

For a short introduction for all staff, BOTI runs POPIA for Every Employee: Handling Personal Information Safely, a 3-hour online masterclass. Teams that need more depth can take POPIA Basic Training over two days.

Secure disposal

Destroying a record is part of managing it. Throwing confidential paper into an open bin, or deleting a file while copies stay on backups and laptops, leaves information exposed.

1. Check the retention schedule and confirm that the period has ended.
2. Confirm that no audit, legal matter or request requires the record to be kept.
3. Get approval from the responsible person.
4. Destroy paper by shredding or a secure destruction service, and delete electronic records from every location where they are held.
5. Record what was destroyed, when, how and on whose authority.

Data management skills beyond records

Some teams searching for data management courses in South Africa need to analyse data, not only store it. Once records are organised, the next step is often reporting. BOTI’s Analysing Data with Excel (2 days) covers working with data in Excel. Data Analytics Fundamentals with Excel and Power BI (3 days) adds dashboards and reports in Power BI.

Who should attend records management training in 2026

Records management training in 2026 suits anyone who creates, files or looks after organisational records:

• Records clerks, registry staff and archivists
• Administrators, office managers, personal assistants and secretaries
• HR, finance and compliance staff who handle confidential information
• Supervisors who need to set filing rules for a team

For related training in office procedures and administration, see BOTI’s Administration and Office Support courses.

Records management certificate: what you receive

Delegates who complete the course receive a BOTI certificate of attendance. The course is a practical skills course, so its value is that your team returns able to apply a working filing, access and retention system. It does not lead to a formal qualification.

Frequently asked questions

What does a records management course cover?

It covers the records life cycle from creation to disposal: classification and referencing, filing and naming, version control, access and security, confidentiality, retention schedules, POPIA and secure disposal. BOTI’s course also covers running a data management assessment and setting policies and procedures.

Do you get a records management certificate?

Yes. Delegates on BOTI’s Mastering Data and Records Management course receive a BOTI certificate of attendance. The course is not accredited and does not count towards a qualification. It is a practical skills course.

How long must company records be kept in South Africa?

It depends on the record. Under the Companies Act, company records are kept for 7 years. Under the Tax Administration Act, tax records are kept for 5 years from submission of the return. For other records, check the law that applies to that record.

Does POPIA apply to records management?

Yes. POPIA, the Protection of Personal Information Act 4 of 2013, has been fully in force since 1 July 2021. It applies to any record containing personal information, so it affects how records are stored, who can access them, how long they are kept and how they are destroyed.

How long is the training and where does it run?

The Mastering Data and Records Management course runs over two days. BOTI runs it in-house at your premises, at its venue in Sunningdale, Johannesburg, or live online.

This course is not accredited. It is delivered as a professional skills programme, and delegates receive a BOTI certificate of attendance.

To build a consistent filing, retention and disposal system in your team, book BOTI’s Mastering Data and Records Management course. Call BOTI on 011 882 8853 or email [email protected]. Training runs in-house at your premises, at BOTI’s venue in Sunningdale, Johannesburg, or live online.