Petty cash is a small pool of physical currency a business keeps on-site to pay for minor, day-to-day expenses, and a privacy code of conduct is the internal policy that tells employees how to collect, store, use, and dispose of personal information. The two sit next to each other in any well-run office because every petty cash voucher captures names, signatures, and sometimes card numbers that fall under the company’s data-protection obligations. Treating them as a single system, rather than two unrelated chores, is what keeps both the money and the data safe.
How a Petty Cash Fund Works
Petty cash operates on the imprest system. The company sets a fixed starting balance, and the total of unspent cash plus receipts on hand must always equal that balance. When cash runs low, the receipts are submitted, verified, and the fund is topped back up to its original amount. The IRS puts it plainly: “The total of the unspent petty cash and the amounts on the petty cash slips should equal the fixed amount of the fund.”1Internal Revenue Service. Publication 583, Starting a Business and Keeping Records
A single person, the custodian, controls the fund. Only the custodian should have access to the cash box or locked drawer. If multiple people dip in and out, reconciliation becomes impossible and the imprest system breaks down. Typical fund sizes range from $50 to $500, depending on how often the office makes small purchases.2Northwestern University. Petty Cash
Common uses include postage, cleaning supplies, small catering orders for meetings, and parking reimbursements. The defining feature is speed: expenses too small and too urgent to route through a formal purchase order or corporate card approval.
What Petty Cash Should Not Cover
Most organizations keep an explicit list of prohibited uses. Personal loans or advances to employees, payroll-related payments, travel expenses, relocation costs, and cashing personal checks appear on nearly every policy. The reasoning is simple: petty cash exists for minor business purchases, not as a workaround for processes that have their own approval chains and audit trails. Running travel or payroll through a cash box bypasses the safeguards those chains provide.
Larger employee reimbursements for out-of-pocket costs also sit outside petty cash. Those go through a separate expense-report system where amounts, receipts, and business purposes are reviewed before payment. Pushing them through a cash box creates record-keeping headaches and increases the chance of errors at reconciliation.
Documenting Every Transaction
Every disbursement needs a paper trail. The IRS expects supporting documents to identify the payee, the amount paid, the date, proof of payment, and a description showing the amount was a legitimate business cost.3Internal Revenue Service. What Kind of Records Should I Keep In practice, each transaction gets a petty cash slip stapled to the merchant receipt. The slip records who received the money, what it was for, the exact amount, and the date.
One threshold worth knowing: the IRS generally does not require a documentary receipt for business expenses under $75, excluding lodging.4Internal Revenue Service. Publication 463, Travel, Gift, and Car Expenses Most petty cash purchases fall below that line. Best practice is still to collect receipts for everything. A missing $12 receipt won’t trigger an audit on its own, but a pattern of undocumented withdrawals will raise questions during an internal review and make year-end bookkeeping painful.
Completed vouchers and attached receipts need to be stored securely. They are tax records, and they contain personal identifiers like employee names and signatures. That is where petty cash management runs directly into privacy obligations.
What a Privacy Code of Conduct Covers
A privacy code of conduct is an internal policy telling employees exactly how to handle personal information belonging to customers, vendors, and fellow employees. Protected categories typically include Social Security numbers, financial account details, home addresses, and any identifier that could be used for identity theft.
At the federal level, the backbone comes from Section 5 of the FTC Act, which prohibits unfair or deceptive business practices, including mishandling consumer data. The FTC defines an unfair practice as one that “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves.”5Federal Trade Commission. A Brief Overview of the Federal Trade Commission’s Investigative and Law Enforcement Authority When a company promises in its privacy policy to protect data and then fails to follow through, the FTC can bring an enforcement action, and settlements have reached into the millions.6Federal Trade Commission. Privacy and Security Enforcement
Beyond the FTC Act, all 50 states plus the District of Columbia have enacted data breach notification laws requiring businesses to alert affected individuals when personal information is compromised.7National Conference of State Legislatures. Security Breach Notification Laws Companies with any European reach also face the EU’s General Data Protection Regulation, which adds requirements like data minimization: personal data must be “adequate, relevant and limited to what is necessary” for the purpose it was collected.8EUR-Lex. Regulation 2016/679 (General Data Protection Regulation) A well-written code translates all of these overlapping obligations into plain rules employees can follow day to day.
Data Minimization in Practice
Data minimization means collecting only the information needed for a specific purpose, and deleting it when that purpose is complete. In a petty cash context, this matters more than it might seem. A voucher needs the employee’s name and the purchase details. It does not need a home address, personal phone number, or Social Security number. If your voucher template asks for anything beyond what accounting and audit genuinely require, the form itself violates the minimization principle.
Review what you store on a schedule. Old vouchers and receipts past their required retention period should be destroyed, not left sitting in filing cabinets. Holding data longer than necessary expands the potential damage if those records are ever seen by someone who shouldn’t see them.
Where Petty Cash and Privacy Meet
Every petty cash transaction generates documents containing personal information: the employee’s name on the voucher, their signature, and often a card number on the merchant receipt. Handling those records carelessly creates exactly the kind of exposure a privacy code is written to prevent.
Redacting Receipts Before Filing
Merchant receipts can display card numbers, and federal law already limits how much vendors may print. Under the Fair and Accurate Credit Transactions Act, a business accepting credit or debit cards may not print more than the last five digits of the card number or the expiration date on an electronically printed receipt.9Office of the Law Revision Counsel. 15 U.S. Code 1681c – Requirements Relating to Information Contained in Consumer Reports Truncation happens at the point of sale, but some receipts still slip through with full numbers, especially from older equipment or handwritten records, which are exempt from the truncation requirement.
Before filing any receipt, black out Social Security numbers, full card numbers, driver’s license numbers, and passport numbers. The receipt’s value as a financial record comes from the vendor name, date, amount, and items purchased. None of the redacted information is needed for accounting or tax purposes, so removing it costs nothing and eliminates a real privacy risk.
Securing Vouchers and Logs
Physical vouchers belong in a locked location with access limited to the custodian and the accounting staff who perform reconciliation or audit. Digital vouchers belong in a system with role-based access controls so only authorized personnel can see employee names and signatures. A stack of completed vouchers left on a shared desk is exactly the small, routine lapse privacy codes exist to prevent.
How Long to Keep the Records
The IRS requires businesses to keep records supporting income, deductions, or credits until the statute of limitations on the relevant return expires. For most businesses, that is a minimum of three years from the filing date. Underreporting gross income by more than 25% extends the period to six years. Claiming a loss from worthless securities or bad debt extends it to seven.10Internal Revenue Service. How Long Should I Keep Records
Employment tax records have their own timeline: at least four years after the tax becomes due or is paid, whichever is later.10Internal Revenue Service. How Long Should I Keep Records Because petty cash can touch both business-expense deductions and employment-tax questions when documentation is thin, four years is a reasonable floor for vouchers and receipts. When the retention period ends, destroy the records securely rather than simply tossing them, to meet your privacy obligations.
What Happens When Privacy Rules Are Broken
Discipline for privacy violations usually follows a progressive structure. A first, unintentional offense may lead to counseling and mandatory retraining. Repeated violations escalate to formal written warnings, suspension, and eventually termination. Deliberate or malicious breaches can lead to immediate dismissal and referral to law enforcement.
Organizational consequences go further. If a breach happens because records were handled carelessly, the company faces notification obligations under the applicable state breach laws, potential FTC enforcement, and civil lawsuits from affected individuals. State-level civil penalties for failing to protect consumer data vary widely but can reach into the hundreds of thousands of dollars per violation. For a small business, a single poorly handled batch of petty cash records containing employee Social Security numbers could trigger obligations far exceeding the value of the fund itself.