CRA record keeping and your electronic records

The basic requirement

The Canada Revenue Agency requires businesses to keep books and records that support their income, expenses, GST/HST and payroll filings. In general, records must be kept for six years from the end of the last tax year they relate to, and some records, such as certain corporate documents, need to be kept longer. Your accountant can tell you which periods apply to your situation.

For IT, the key point is that keeping records is not enough. You must be able to produce them in a readable form when CRA asks, which may be years after the software that created them has been replaced. Planning for that future retrieval is where many small businesses fall short.

Electronic records and scanned documents

CRA accepts electronic records, but they must be complete, reliable and readable. If you scan paper receipts and invoices and then destroy the originals, follow CRA's published guidance on imaging so that the scanned copies are acceptable. Scans should be legible, include both sides where needed and be stored in a way that prevents later alteration.

If your records are kept outside Canada, for example in a cloud accounting platform, review CRA's current guidance on where electronic records may be kept and how they must be made available. Rules in this area have changed over time, so confirm with your accountant rather than relying on old advice.

Software changes and old systems

Businesses often switch accounting, point of sale or payroll systems every few years. When you do, the old data does not disappear from your legal obligations. Before cancelling an old subscription or retiring a server, export the full history in a format you can still open, such as PDF reports and CSV or Excel files, and store it with your other records.

For desktop accounting software, keep a copy of the final data file along with a note of the version needed to open it. If the software itself may not run on future computers, produce printed or PDF reports of the key ledgers and statements as a fallback. Store these alongside the data file.

• Export full transaction history before cancelling a cloud subscription
• Label archives with the system name, date range and format
• Store archives in at least two locations, one offsite
• Test that an archive opens before deleting the source

Backups versus archives

A backup is designed to restore systems after a failure, and it usually keeps a limited number of versions. An archive is designed to keep specific records for a defined retention period. Relying on backups alone for CRA purposes is risky, because older backup sets are often rotated out or tied to software that is no longer in use.

Treat tax and financial records as an archive with its own retention schedule. Review it once a year, delete records that are past their retention period after confirming with your accountant, and keep a short log of what was destroyed and when. An archive kept in a separate, access-controlled location is also less likely to be affected by the same incident that damages your live systems.

Protecting financial records

Financial records contain personal information about employees and customers, including social insurance numbers, banking details and addresses. That means privacy law applies alongside CRA rules. Limit access to finance staff and your accountant, use multi-factor authentication on accounting platforms and keep archived records encrypted. Review who has access at least once a year.

When retiring computers that held accounting data, wipe the drives properly or use a certified destruction service. A forgotten laptop in a storage room can expose years of payroll and banking information if it is lost or resold. Keep the destruction certificate or a short record of the wipe with your other retention records, so you can show the information was disposed of properly.