Retention periods digitally: schedules, holds, deletion runs

The retention duty comes from commercial and tax law. It addresses the company as a merchant and taxpayer and says, in substance: certain records must remain available long enough for a knowledgeable third party to follow the course of business within a reasonable time. This covers books and records, inventories, annual accounts, accounting vouchers and the commercial and business letters received and sent. Electronic retention adds a second requirement: the records must stay unalterable, legible and machine-readable, and the way this is achieved must be described. That description is the process documentation required under the German principles for the proper keeping and retention of books (GoBD).

The deletion duty comes from data protection law and targets something different: not records, but personal data. The storage limitation principle requires data to be kept in a form that allows identification of a person only for as long as the purpose demands (GDPR). Once the purpose falls away and no other legal basis applies, a deletion duty arises. Data subjects can also request erasure themselves, and the company then has to check whether one of the statutory exceptions applies, such as an existing retention obligation.

The apparent contradiction dissolves as soon as the data stops being treated as one mass. An outgoing invoice contains personal data and is subject to a retention duty: it stays until the period expires and is deleted afterwards. An unsuccessful application also contains personal data but carries no retention duty: it goes once the process has ended and the period for possible claims has passed. An access log in the document archive serves traceability and needs its own, usually shorter, retention period. The question is never whether to retain or to delete, but for how long, starting when, and what happens afterwards.

The basic tax periods are manageable. Ten years apply to books and records, inventories, annual accounts, management reports and the opening balance sheet. Accounting vouchers also carried ten years; in 2024 this was reduced to eight, with a transitional rule for vouchers whose period was still running at that point and a separate rule for certain financial service providers (German Fiscal Code). Six years apply to commercial and business letters received, to copies of those sent, and to other records where they matter for taxation. Commercial law follows the same structure for merchants (German Commercial Code).

Alongside these sit periods from other areas of law that are more often overlooked. Payroll accounts must be kept until the end of the sixth calendar year following the last entry (Income Tax Act). Records of working time must be kept for at least two years (Working Hours Act), as must the records required under the Minimum Wage Act. Social insurance records follow their own logic tied to the audit cycle. And regardless of any retention duty, it can make sense to keep contract records for as long as claims can be brought from them; the standard limitation period is three years and starts at the end of the year in which the claim arose (German Civil Code).

The table works as a starting point, not as a decision. How a specific record is classified depends on its content, not on its file name: a quotation without a subsequent order is something different from a quotation that became the basis of a contract. That is precisely why the retention schedule is drawn up together with the tax adviser and reviewed once a year.

A filing concept does not start with folder structures but with a list of document types. For the daily work of a mid-size company, 20 to 40 types are usually enough to cover the vast majority of the volume (project experience). Anything beyond that falls into a catch-all category that is deliberately kept small and reviewed regularly. Each type gets four entries: the period, the point at which it starts, whether a hold can be set, and the location where the leading version sits. Only then comes the question of what the filing looks like technically.

The location is the part that decides whether the concept works. A retention schedule that only covers the archive system, while the same records also sit in mailboxes, on shared drives and in a legacy system, describes a wish rather than a state. The stocktake therefore has to include an honest survey of every place where documents arise and stay, and a decision on which place is the leading one. All other versions are either abolished or explicitly declared as copies subject to the same deletion run. That decision then belongs in the process documentation so that it survives a change of staff.

The deletion run is the point at which a concept turns into practice. In most companies one or two runs a year are enough, sensibly placed after the annual accounts and after any pending audits have closed (project experience). What matters is less the frequency than the repeatability: the run has to be described well enough for a different person to carry it out, and it has to leave behind a result that can be produced later.

A proven sequence works in two stages. First the system produces a proposal list: every record whose period has expired and for which no hold exists, grouped by document type and year. That list goes to the responsible roles for approval, not for an item-by-item content review but to confirm that no known reasons stand in the way. Deletion only follows approval. The log records what was deleted, in what quantity, under which rule, when and by whom. It deliberately contains volumes and identifiers rather than content, so that it does not build up a new personal data holding of its own.

Besides duration, a filing concept also governs access. Records subject to retention must stay legible and machine-readable throughout the period, and changes to them must be recognisable (GoBD). In practice that means three things: an archived document is not overwritten but supplemented by a new version; access is governed by role so that not every person can open every personnel file; and the formats in use are chosen so that they can still be opened in eight or ten years.

The second part concerns the description itself. Process documentation records how documents enter the company, how they are captured, indexed, filed, secured and deleted, and who is responsible for each step. It is not an end in itself but the answer to the question an audit actually asks: how do you ensure that things run the way you describe them? A retention schedule without process documentation remains a statement of intent. The reverse also holds: documentation that does not match the actual workflow does more harm than none, because it evidences a deviation.

Where scanning is involved, the handling of the paper original belongs in the same document. Whether and when paper vouchers may be destroyed after scanning depends on the type of voucher and on how the scanning process is set up, and it forms part of the same documentation. That decision should be taken before the first scanning batch and agreed with the tax adviser rather than afterwards.