Payroll Records in Tanzania: Five Years Is the Floor

This page is the payroll retention operating file: which documents an employer must keep, under which instrument, and how long before disposal is safe. It is not a deduction manual and not a substitute for the labour officer’s own list.

• Deductions and returns: payroll compliance
• Rates behind the schedules: 2026 rate map
• Non-citizen staff on the register: residence permits
• Workplace registration: OSHA registration

As at 14 September 2026. This file rests on Cap. 438, Cap. 332, the labour and fund statutes named below, and the 2022 data-protection duty; where a Finance Act may have moved a rate, confirm the live schedule on tra.go.tz.

Which desks can open your payroll cabinet

Payroll is not one record set with one keeper. TRA opens it for pay-as-you-earn under the Income Tax Act Cap. 332, for the skills levy under the Vocational Education and Training Act Cap. 82, and for the keeping duty itself under Cap. 438. The National Social Security Fund Act Cap. 50 gives NSSF an inspection right over contribution schedules. The Workers Compensation Act Cap. 263 gives WCF an assessment right over declared earnings. A labour officer appointed under the Labour Institutions Act Cap. 300 enforces the written-record obligation in the Employment and Labour Relations Act Cap. 366.

Each arrives with its own list. An employer answering one desk well and the rest from memory is running four files. The attendance record proving hours worked also proves the levy base and the contribution schedule: produce it once, in a shape all four accept.

The retention clocks, and why five years is only a floor

The clocks start at different moments and run to different ends. Retiring a document on the shortest destroys evidence a longer one still wants.

Two tails stretch it further. TRA may amend an assessment inside its statutory window, and that window does not close in the ordinary way where fraud or gross negligence is alleged: a purge at five years is only safe on a clean file. A member claiming benefit decades later may ask you to evidence a month the fund cannot trace. Dispute windows run the other way: a termination complaint reaches the Commission for Mediation and Arbitration within 30 days, other disputes within 60 days under Cap. 300.

What counts as a payroll record

Not the payslip alone. A complete set starts with the written statement of particulars Cap. 366 requires on engagement, the signed contract, and any fixed-term renewal. Then attendance or muster rolls, overtime authorisations, the leave register, the monthly payroll register, the individual payslip and the per-employee tax computation. Then proof the money reached the worker: a bank payment file, or a cash acquittance the employee signed.

Behind those sit the authorities for every non-tax deduction (union dues, staff loans, court attachment orders), and the statutory bundle: contribution schedules, control numbers, payment references, the certificate of tax deducted, the half-year withholding statement. The file ends with the leaver: termination letter, final dues computation, certificate of service.

The monthly trail those records have to support

Tax withheld from salary is remitted by the seventh day of the month after deduction under Cap. 332, with a withholding statement filed within thirty days of each six-month period end and a deduction certificate issued to every employee. The skills levy under Cap. 82 runs at 3.5% of gross emoluments where the employer has ten or more staff, remitted monthly alongside it.

Social security under Cap. 50 takes 20% of gross pay (10% from the employer, 10% withheld from the worker) due in the month after the wage month; arrears attract 5% for each month they stay open. The compensation fund assesses a separate employer contribution on declared earnings at a rate it sets and has revised by notice; confirm that figure with WCF, not a rate hard-coded in software.

Each produces a control number, a payment reference and a schedule. The reference proves you paid something; only the schedule beside the register proves you paid correctly.

Mainland and Zanzibar keep different cabinets

Income tax is a Union matter, so TRA assesses employment tax on both sides of the channel and the Cap. 438 keeping duty travels with it. Nearly everything else splits. The skills levy sits in a Mainland statute; a Zanzibar employer confirms its position with the Zanzibar Revenue Authority rather than assuming it applies. Island social security sits with the Zanzibar Social Security Fund.

Records for staff engaged there are kept under the Employment Act No. 11 of 2005 and inspected by the island labour desk, not under Cap. 366. Registrar filings divide the same way: BRELA on the Mainland, BPRA in Zanzibar. A group employing on both sides keeps two record sets against one tax file.

Closing a payroll month so it survives a visit

1. Freeze the attendance record before the run: days present, leave taken, overtime authorised, joiners and leavers dated.
2. Reconcile headcount against the prior month, writing the reason for every movement and every part-month payment.
3. Compute and remit the tax and levy through the TRA portal, filing the control number with its register.
4. Lodge the contribution schedules with the pension and compensation funds, matching every name and membership number to that register.
5. Pay from an account that traces: a bank file or signed acquittance sheet, never an unrecorded cash box.
6. Issue payslips and file the acknowledgements with the month, not in a personnel drawer.
7. Close it as one indexed bundle, filed by period rather than scattered across four desks.

The pack an inspector opens

Expect a request for the taxpayer identification number, employer registration, the registrar’s extract, and written particulars for each named person. Then contracts and renewals; permits for non-citizen staff with expiry dates; attendance sheets for the months chosen; registers, payslips and the leave register; contribution schedules and payment evidence; the workplace certificate issued under the Occupational Safety and Health Act Cap. 297; and leaver files from the period.

An officer samples months rather than reading a year. That is why a single gap is expensive: it reads as system failure, not accident, and the sample widens.

Illustrative arithmetic: what one missing month costs

Illustrative arithmetic, not a quotation. A Dar es Salaam manufacturer employs 42 people on a gross monthly payroll of TZS 96,000,000.

• Skills levy at 3.5%: TZS 3,360,000 for the month, TZS 40,320,000 across twelve.
• Pension at 10% from the employer: TZS 9,600,000, matched by TZS 9,600,000 withheld, so TZS 19,200,000 should reach the fund.
• If that month goes unlodged, the 5% monthly charge on the employer share alone adds TZS 480,000 for every month it stays open.

The exposure is not one month. It is the assessment raised across the open window when a desk cannot see who was paid, plus the time spent rebuilding attendance for 42 people from bank statements.

Format, language, and where the file must physically sit

Cap. 438 requires documents to be maintained in the United Republic and in Kiswahili or English. Cloud payroll on a foreign server does not remove that duty. What defeats employers is rarely format but the inability to print a readable copy on the day: keep an in-country copy the vendor is not needed to open.

Electronic records carry legal weight under the Electronic Transactions Act No. 13 of 2015, so scanned bundles work. Two habits follow. Export historical registers before a payroll licence lapses or a bureau ends: a supplier who stops replying takes years of evidence away. And keep wet-ink items as paper too: contracts, acquittances, payslip acknowledgements, termination letters.

Payroll is also personal data

A payroll file holds names, national identification numbers, bank details, salary, next of kin, sometimes medical information. The Personal Data Protection Act No. 11 of 2022 and the regulations made under it in 2023 put that inside a controller’s duties, and the Personal Data Protection Commission maintains the register of controllers. Confirm your registration class and the current fee with the Commission.

Retention has to be bounded at both ends. Holding a leaver’s file indefinitely is as much a finding as destroying it early, so set a disposal date from the longest clock that applies and minute it when it happens. Restrict access to payroll staff and auditors; an open network share of salary data is what complaints are built on.

Where this file stalls

• The system prints a register but nothing sits behind it, so overtime cannot be evidenced.
• Casual and piece-rate workers paid in cash, with no signed sheet or note of days engaged.
• Schedules quoting membership numbers the fund cannot match, so payment sits unallocated while the charge runs.
• Staff working in Tanzania but paid by a sister company abroad, with nothing on a local register.
• The levy computed on basic pay only, or never started after the ten-employee line was crossed.
• Expired permits for non-citizen staff still drawing salary, turning a payroll visit into an immigration file.
• A leaver’s bundle destroyed at twelve months because an internal policy said so.

What has moved recently

Filing migrated from counter to portal: employment tax and the levy are declared and settled online against control numbers, so proof of payment is now a system reference, not a stamped receipt. File it with the register: a bank statement line alone does not identify what was settled.

The data-protection duty is newer than most retention policies sitting in Tanzanian HR manuals. A schedule written before 2022 applies half the rule and has no disposal discipline at the far end. Rates and thresholds here have also moved in successive Finance Acts and fund notices: treat any figure hard-coded in software as a setting to re-verify each July.

Mandate-holders this file does not replace

TRA owns employment tax, the skills levy and the keeping duty. NSSF owns membership and contribution history, and the fund, not the employer, decides entitlement. WCF owns assessment and the compensation claim. A labour officer owns the written-record obligation; the CMA owns the dispute that follows. OSHA owns workplace registration and occupational health records. The data-protection regulator owns the controller register.

A licensed auditor owns the opinion on the payroll figure in the accounts; an advocate owns a contested termination. Zatra prepares, structures and coordinates the file and its calendar; it does not practise law, audit, or issue approvals, and no outcome at these desks is promised.

What to confirm before you act

• The live levy rate, employee threshold and contribution split on the mandate-holders’ own portals.
• Whether your schedule runs from the income year’s close or from the last entry: different dates, different disposal months.
• That an in-country, readable copy of every closed month exists outside the payroll software.
• Your controller registration position with the data-protection regulator.
• Which side of the channel each employee is engaged on, and which fund and inspectorate follows.
• The permit expiry dates of every non-citizen drawing a salary.