Protection of records

Plain-language summary

Protecting records against loss, destruction and falsification, and against access or release without authority, for as long as they must be kept, and disposing of them properly afterwards, in line with legal, regulatory, contractual and business requirements.

What the clause is really asking

Records are the information you must be able to produce later, sometimes years later, and prove has not been altered: financial records, employee files, contracts, quality and production records, logs. This control asks you to keep records safe from being lost, destroyed or falsified, and from being accessed or released without authority. In practice that means a retention schedule stating each record type, how long it must be kept and why (the law, contract or business need), where it is held and how it is disposed of; storage that protects integrity and availability for the whole period, including formats that stay readable as technology changes and media that do not degrade; access control; and authorised, recorded destruction at the end. The common misunderstanding is that keeping everything forever is the safe option. POPIA section 14 requires that records of personal information are not kept longer than necessary for the purpose, unless a law, contract or another listed reason requires it, and are then destroyed, deleted or de-identified. ISO 9001 practitioners already control records under 7.5.3; extend that schedule rather than starting a new one.

What auditors look for

Auditors ask for the retention schedule and test it with a few record types: where are the 2019 payroll records, the customer contracts, the CCTV footage, the unsuccessful job applications? They check that each retention period has a stated basis and that records past it have been disposed of, with a record of disposal. They look at how integrity is protected for records that might be challenged, such as audit logs and signed documents. They ask about old formats and backup tapes nobody can read. For personal information they ask how POPIA section 14 is applied. The hard question: show me something you destroyed because its retention period expired.

Typical evidence

Records retention schedule with record types, periods, legal basis, location, owner and disposal method; records management procedure; access controls on record stores; integrity protections such as write-once storage or audit trails; destruction certificates and disposal logs; format and media migration records; POPIA section 14 retention justifications for personal information.

How to comply — recommendations

Extend the ISO 9001 record control table into a full retention schedule covering finance, HR, contracts, IT logs and CCTV as well as quality records. For each record type give the retention period and its basis (for example the Companies Act, the Tax Administration Act, the Basic Conditions of Employment Act or a customer contract), the owner, the system or place it lives in, and the disposal method. Switch on retention policies in Microsoft 365 or your document system where you can. Hold an annual disposal day for paper and electronic records past their period, with a destruction certificate. Check once a year that archived records can still be opened.

Common nonconformities

No retention schedule, or one covering only quality records; retention periods with no stated legal or business basis; personal information kept indefinitely contrary to POPIA section 14; records destroyed without authorisation or record; archived records unreadable or on degraded media; no integrity protection for records that may be needed as evidence; shared drives where anyone can delete controlled records.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free downloadMaster Document RegisterThe register at the centre of document control: every controlled document with its number, owner, current revision, status and next review date.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free demoDocument-control demoA live register, revisions, approvals and an audit pack — no sign-up.