Insights · Published 8 November 2026
Most businesses have one of two problems with old records. Either they keep everything forever, in filing cabinets, old laptops, email and drives nobody has opened for years, or they throw things away without thinking and cannot find an invoice when the tax office or an auditor asks for it.
Both cost money. Keeping too much means more to protect, more to lose in a breach and more to search through. Deleting too soon can leave you unable to prove a payment, defend a dispute or answer an official query. A simple retention schedule fixes both.
The principle: keep what you need, for as long as you need it
Ghana's Data Protection Act, 2012 (Act 843) sets out principles for handling personal data, including that personal data should not be kept for longer than is needed for the purpose it was collected. Personal data includes staff files, CVs from applicants, customer details, student and patient records, and copies of ID cards.
Other records, such as accounts, invoices, payroll and contracts, may need to be kept for set periods for tax, employment or legal reasons. We are not lawyers or accountants, and the rules can change, so we will not quote specific periods here. Confirm the right periods for your business with your accountant, your lawyer or the relevant authority, such as the Ghana Revenue Authority for tax records.
Build a simple retention schedule
A retention schedule is just a table. For each type of record, write down what it is, where it is kept, who owns it, how long you keep it and why, and what happens at the end.
Start with the records you actually have. A typical small business list might include accounting records and invoices, payroll and staff files, job applications from people you did not hire, customer and supplier contracts, customer contact details, CCTV footage, and email. A school or clinic will also have student or patient records, which deserve particular care.
Once your accountant or lawyer has helped you fill in the periods, set a regular date, once or twice a year, to review and delete what has passed its date. Put a name against the task, or it will not happen.
Where copies hide
Deleting a file from the shared folder is rarely the end of it. Copies spread, and a proper clean-up means looking in all the usual hiding places.
- Email: attachments in sent items, inboxes and archived mail, often for years
- Laptops and desktops: the Downloads folder, the desktop and old Documents folders
- WhatsApp: photos of ID cards, invoices and payment screenshots on staff phones
- USB drives and external disks lying in drawers
- Personal cloud accounts that staff used to move files home
- Old backups, which keep everything you deleted until they expire
- Paper: printouts, photocopies of IDs and filing boxes in the store room
Backups and retention
Backups are meant to keep things. That is their job. But a backup kept forever also keeps data you were supposed to delete. Agree with whoever runs your backups how long old backups are kept, so deleted data eventually ages out. This is a balance: long enough to recover from a problem you discover late, not so long that you keep personal data indefinitely.
Disposing of old computers and drives safely
Old PCs, laptops and phones are often sold, given to staff or left with a repair shop. Deleting files or emptying the recycle bin does not remove the data. With free tools, someone can often recover it.
Before a computer leaves the business, the drive needs to be properly wiped with software designed for the job, or removed and kept. For modern laptops with encryption switched on (BitLocker on Windows, FileVault on Mac), resetting the device and removing the encryption key is a strong option. For drives that will not work any more, physical destruction is the safest answer. Keep a short record: which device, its serial number, how it was wiped, by whom and when.
For phones, remove the business accounts, then do a full factory reset. Check that WhatsApp backups and photos have gone with it.
For paper, use a shredder or a secure shredding service, not the general rubbish.
Your checklist
A simple start for this month.
- List the main types of records you hold and where they are kept
- Ask your accountant and lawyer to confirm retention periods for each
- Write a one-page retention schedule with an owner for each record type
- Agree how long old backups are kept
- Ask staff to clear IDs and payment screenshots from WhatsApp and Downloads
- Set a twice-yearly review date for deleting expired records
- Wipe or destroy drives before any device leaves the business, and log it
Dalysie Ghana can help you map where your data lives, set up sensible backup retention and wipe old devices properly.