The instinct in property is to keep everything, indefinitely, in case it is ever needed. It feels like the cautious option.
It isn't, for two reasons. Holding personal data you no longer have a reason to hold is a liability under Kenya's Data Protection Act, 2019. And an archive nobody has ever pruned is one nobody can search, which means in practice you cannot find the thing you kept it all for.
This is not legal advice. Periods vary with the record and your own obligations, and it is worth taking advice if you hold data at scale. But the shape of a workable position is straightforward.
Decide by category, not by document
Group what you hold, then set a rule for each group:
Financial records: receipts, invoices, ledgers, remittance statements. These are your evidence in any dispute and are usually subject to tax and accounting retention requirements. This is the longest-kept category, and the one where "keep it" is normally the right answer.
Tenancy records: agreements, handover inventories, meter readings, correspondence about repairs. Useful for the length of the tenancy plus a defined period after, because deposit and condition questions surface after someone has left.
Applicant records: the people who enquired, viewed, or applied and were not offered a unit. This is the category almost everybody keeps forever and almost nobody should. There is rarely a reason to hold an unsuccessful applicant's ID copy and employment details indefinitely.
Marketing contacts: anyone who asked to hear from you. Keep while the consent is live, and delete when it is withdrawn or has gone stale.
Write the periods down
An unwritten retention policy is not a policy; it is a habit that changes with whoever is doing the filing. Write one page: category, how long, and the reason. The reason column is what makes it defensible, and what makes it obvious when a period no longer makes sense.
Then actually delete
This is the step that never happens. A retention policy that is never executed is worse than none, because it documents precisely how long you said you would keep things and proves you didn't.
Put a recurring date in the calendar. Twice a year is enough for most agencies.
Don't forget the informal copies
The management system is the easy part. The hard part is the scanned IDs in a WhatsApp group, the spreadsheet on someone's personal laptop, the folder of application forms in a drawer, the email attachments in four inboxes.
Deleting the record from the system while five copies live elsewhere is filing, not deletion. See handling tenant data responsibly for how those copies accumulate in the first place.
The other half: don't lose what you should keep
Retention has a mirror. Backups that have never been restored are a belief rather than a control, and records held only on one person's device leave with that person.
Test a restore once. Most people discover something the first time they try, and it is much better to discover it on a Tuesday than in the week you actually need it.
A retention schedule you can actually write this week
One page, six columns, and it does not need a lawyer to draft the first version: category, what it includes, how long, measured from when, why, and who is responsible for deleting it.
The "measured from when" column is the one people leave out, and it causes most of the confusion. A tenancy file kept "for five years" means nothing until you say five years from what. It is the end of the tenancy, not the start, or you are deleting files while the tenant is still living there.
A workable structure:
Financial records. Receipts, invoices, ledgers, bank and mobile money statements, landlord remittance statements. Measured from the end of the financial year they belong to. Longest period of anything you hold, driven by tax and accounting obligations, and the category where keeping is almost always the right call.
Tenancy records. The signed agreement and variations, handover inventories and photographs, meter readings, notices with proof of service, repair history, deposit records. The full list is in what records a landlord should keep. Measured from the end of the tenancy, and long enough to cover the period in which a claim could still be brought.
Applicant records. Enquiries, viewings, applications from people you did not house. Measured from the decision, and short. Weeks or months, not years. This is the largest unnecessary holding in most agencies.
Employment and contractor records. Measured from the end of the engagement, per the applicable employment obligations.
Marketing contacts. Held while the consent is live, deleted when it is withdrawn or has gone stale.
CCTV and access logs. Short, and defined, because these are high-sensitivity records with a narrow purpose. A camera system that keeps everything forever because nobody configured it is a retention decision made by a default setting.
The "why" column is what makes the whole document defensible, and it is also what tells you when a period has stopped making sense. A period whose reason nobody can state is a period nobody chose.
What "delete" has to mean
Deletion that leaves the record findable is filing. The list of places to work through, in the order they are usually forgotten:
- The management system, including its archive, its recycle bin and its exports folder.
- Backups. These are genuinely hard: a record deleted today persists in backup sets until they rotate. The workable position is a defined backup retention period, documented, so the record disappears on a known schedule rather than living forever in an image nobody can search.
- Shared drives and the personal folders inside them.
- Email, including sent items and attachments, across every inbox that ever touched it.
- WhatsApp groups and the phones of everyone in them. This is the hardest and the reason to stop circulating ID copies in the first place.
- Paper. Filing cabinets, the box in the store, the drawer in the caretaker's office. Shredded, not binned.
- Devices leaving the business: a laptop sold, a phone replaced, a departing staff member's handset.
Two decisions make this survivable. Keep an index of where each category lives, so a deletion run is a list to work rather than an archaeology exercise. And prefer one system of record over copies: every additional place a document lives is another place it has to be deleted from and another place it can leak.
Where a record must be kept for a legitimate reason but no longer needs to identify anyone, as with historic consumption for utility planning, consider anonymising it instead of deleting it. Data that no longer identifies a person stops being the kind of holding this whole article is about.
Legal holds, and the exception that overrides the schedule
One rule sits above the schedule: if a dispute, claim, investigation or audit is live or reasonably anticipated, stop deleting anything connected to it, whatever the period says.
Deleting on schedule is defensible. Deleting on schedule after receiving a demand letter is not, and the schedule will not protect you. It will be the document used to show the deletion was foreseeable. Note the hold in writing, name what it covers, suspend the routine deletion for that category, and lift it only when the matter is genuinely closed.
Running the twice-yearly purge
Put two dates in the calendar and treat them as operational work rather than housekeeping:
- Produce the list. Everything past its period, by category. Ideally your property management software produces it, because a list assembled by hand is one that stops being produced by the second cycle.
- Check for holds. Anything connected to a live dispute comes out of the list.
- Delete, across every location on the index, not just the primary system.
- Record what you did: categories, volumes, date, who performed it. Not the contents. A log proving the policy is executed is what turns a written policy into evidence of a practice.
- Review one period. One category per cycle: is this still the right length, and can anyone state the reason?
None of this is legal advice, and periods differ with the record, your obligations and the circumstances. Take advice if you hold data at scale. What is not in doubt is that a schedule that is written and executed twice a year puts you in a completely different position from one that exists as an intention.
Common questions
How long should a landlord keep tenancy records in Kenya?
Long enough to cover the period in which a question or claim could still arise, measured from the end of the tenancy rather than its start, with financial records normally kept longest. Set the specific periods with advice rather than adopting a number from an article.
Can I delete a former tenant's data on request?
Where you have no lawful reason to keep it, yes, and people have the right to ask. Where you do, whether an open balance, a tax retention obligation or a live dispute, you can decline for that reason and should say what the reason is, then delete when it lapses.
Do I need to keep ID copies of applicants I did not house?
Rarely. Ask whether sighting the ID and recording the number served the purpose, and if it did, stop taking the copy. It is the single easiest reduction in risk available to a property business.
What happens if I keep data too long?
You carry a liability for data that is doing you no good, you have more to disclose and protect in an incident, and you have an archive nobody can search, which usually means you also cannot find the document you kept everything for.
Are backups covered by a retention policy?
They have to be, or deletion is theatre. Define how long backup sets are kept, document it, and accept that a deleted record persists until those sets rotate. That is a defensible position, and an undefined backup retention is not.
What should stop a scheduled deletion?
A live or reasonably anticipated dispute, claim, audit or investigation. Record the hold, name what it covers, and lift it only when the matter is actually closed.