> ## Content Index > Fetch the complete content index at: https://beathantechnologies.com/blog/llms.txt > Use this file to discover other available public pages before exploring further. # PSIRA and POPIA: what you actually have to keep, and for how long - URL: https://beathantechnologies.com/blog/psira-popia-records/ - Published: 2026-09-29T08:00:08.000Z - Updated: 2026-10-05T12:28:56.000Z - Description: PSIRA wants you to prove every guard was registered and competent on the night they worked. POPIA wants you holding less, for less time. The visitor book on the counter is failing both. - Author: Liam van Huyssteen - Tags: Security operations, Sentry, #kw: PSIRA compliance Two sets of rules govern the paperwork in a South African guarding business, PSIRA compliance and POPIA, and they pull in opposite directions. PSIRA wants you to be able to show that every guard you deploy is registered, trained and competent, on the day you deployed them. POPIA wants you to hold as little personal information as possible, for no longer than you need it, and to protect what you do hold. Most operators are quietly failing both, in the same filing cabinet. ## The PSIRA half: compliance is about expiry dates Registration is not a one-off. It lapses. Firearm competency lapses. Training certificates have dates on them. The compliance question is never "do we have a copy of his certificate", it is "was it valid on the night he worked". That is a different question and a spreadsheet answers it badly. A spreadsheet tells you what you typed in the day you typed it. It does not tell you that three guards rostered for Friday have competencies expiring Thursday. What that needs is documents stored against the person with their expiry dates as real dates, and a system that looks ahead rather than being queried. [Sentry's Asset & Compliance module](https://beathantechnologies.com/sentry/asset-compliance) tracks these as compliance documents with expiry dates and emails a reminder before each one lapses, so an expiring registration surfaces before it becomes a guard on site who should not be. The test of whether your current method works: can you answer, right now, which of your guards has something expiring in the next thirty days? If answering takes longer than a minute, you do not have a compliance system, you have a folder. ## The POPIA half: the visitor book is the problem Walk into most guard huts and there is an A4 book on the counter. Name, ID number, vehicle registration, who they are visiting, time in, time out. Open to the page, in a room that everyone entering the site passes through. That book holds hundreds of identity numbers, visible to every subsequent visitor who signs under the previous one. It has no access control, no retention period, and no record of who has read it. If it goes missing nobody knows, and if somebody photographs a page nobody ever finds out. It is one of the clearest POPIA exposures in the industry and it is sitting in plain sight because it has always been there. A digital visitor log fixes the structural part of this. Records are access controlled, so a visitor cannot read the previous visitor's details. [ID documents, passports and driver's licences are scanned](https://beathantechnologies.com/sentry/visitor-management) rather than transcribed, which removes both the legibility problem and the copying error. Exports can be masked, so an operations report showing who was on site does not need to carry full ID numbers. And retention becomes a setting rather than a decision nobody made. ## Retention is the part everyone skips POPIA does not tell you to keep nothing. It tells you to decide, justify and stick to it. The failure mode is not keeping data for too short a time. It is keeping everything forever because deleting felt risky and nobody wanted to choose a number. Seven years of visitor records, clock-in photographs from 2019, ID scans of contractors who came once. So choose the number. In Sentry, [clock-in selfies](https://beathantechnologies.com/sentry/roll-call) default to 120 days and you can set your own period; the point is not that 120 is correct for you, it is that a period exists, it is written down, and deletion happens automatically rather than when someone remembers. ## Where the two halves meet The tension is real but narrower than it looks. PSIRA compliance needs documents about employees, held while they are employed and for a defined period after. POPIA is satisfied by that as long as the period is defined and the access is controlled. The visitor register is different: you need it for a shorter time, for a narrower purpose, and it contains other people's information rather than your own staff's. Treating both with the same retention rule is how operators end up holding visitor ID numbers for seven years because that is how long they keep employment records. We are not lawyers and this is not legal advice. --- *Next in this series:* [*what an emergency button should refuse to do*](https://beathantechnologies.com/blog/panic-button-unidentified/)*.*