Document Retention Requirements: What Companies Must Keep and How Long

Why retaining and deleting belong together

Most owners know the rule of thumb that tax records must be kept for ten years. In daily practice, this often becomes: we keep everything as long as we can. That feels safe, but it is not. Whoever keeps everything finds little when it matters, pays for space and storage, and may breach data protection rules in handling personal data.

This leads to the guiding question of this assessment: What must a small company keep and for how long, and how does it organize retention and deletion so that both succeed with little effort? To answer it, we first clarify the terms and the periods as of November 2026. Then we introduce a thinking model that connects retention and deletion duties, look at electronic documents, weigh two perspectives, and describe a one-page retention plan.

Terms: retention duty, period, start of the period

A retention duty requires certain documents to be kept complete, orderly, and readable for a defined time. For companies in Germany, the most important ones arise from commercial law (Section 257 of the Commercial Code, HGB) and tax law (Section 147 of the Fiscal Code, AO), and for invoices also from the VAT Act (Section 14b UStG). The retention period is the minimum duration. A business letter is any document that prepares, concludes, or reverses a transaction, such as a quote, an order confirmation, or a contract, whether on paper or by e-mail.

The start of the period is important. The period does not run from the date on the document but from the end of the calendar year in which it was created or the last entry was made. An invoice dated March 15, 2018, must therefore be kept for eight years from December 31, 2018, that is, until December 31, 2026. It may be destroyed from January 1, 2027. The period is extended as long as the document still matters for a tax assessment, for example during an ongoing tax audit, with provisional assessments, or in pending appeal, criminal, or administrative fine proceedings (Section 147(3) AO).

The periods at a glance: ten, eight, and six years

The Fourth Bureaucracy Relief Act shortened the period for accounting vouchers from ten to eight years. It has applied since January 1, 2025, to all vouchers whose period had not yet expired at that date. That leaves three periods under tax and commercial law. Shorter periods from labor law and guidance for personnel records come on top.

Contracts deserve a second look. The tax period runs from the end of the year in which the letter was sent. Claims under the contract may last longer, however, for example for warranty or a limitation period that begins later. Many companies therefore keep contracts until a few years after the contract ends. That is not a legal requirement but a precaution for evidence.

The thinking model: two clocks for every document

Two clocks run for every document, pointing in opposite directions. The first is the retention clock from commercial and tax law. It says: not before. A document may not be destroyed before it runs out. The second is the deletion clock from data protection. Under the principle of storage limitation in Article 5(1)(e) GDPR, personal data may be stored only as long as necessary for its purpose. It says: not after.

One rule connects the two clocks. As long as a statutory retention duty exists, it rules out the right to erasure (Article 17(3)(b) GDPR). Once it has expired and there is no other purpose, the duty to delete begins. The image of a parking meter helps: you may not drive off before the minimum time, and you may not stay beyond the maximum parking time. A company that keeps everything is permanently parked in a no-stopping zone.

Electronic documents, e-invoices, and GoBD

The GoBD, the German principles for the proper keeping and retention of books, records, and documents in electronic form, set out how digital documents are to be kept. The core: what was created or received electronically is kept electronically, complete, unalterable, and readable for the entire period. A printout of an e-mail with an invoice is not enough if the invoice arrived electronically. Paper vouchers may be scanned and then destroyed if the procedure is documented and the image matches the original.

For the e-invoice, which every company in Germany has had to be able to receive since 2025, the Federal Ministry of Finance amended the GoBD by letter of July 14, 2025. What must be kept is the structured data set. For hybrid formats such as ZUGFeRD, according to professional bodies, the human-readable image file only has to be kept in addition if it contains further tax-relevant information. How the changeover succeeds overall is described in the article on mandatory e-invoicing.

• Unalterable: storage in a system that logs or prevents changes, not in a freely editable folder.
• Readable: even after a software change, old data must remain readable. Before a program is switched off, its data is saved in readable form.
• Domestic: documents must in principle be kept in Germany. Electronic storage in another EU member state is possible under conditions (Section 146(2) AO).
• Backed up: a backup kept only at the same location does not protect against fire or encryption by malware.

Software changes in particular are underestimated. Whoever switches off a tool, as the guide on tool sprawl recommends, must first clarify which data must be retained. What a folder structure looks like in which you can still find it years later is shown in the article on digital filing.

Keep everything or delete deliberately? Two perspectives

The first view says: better too much than too little. A missing voucher can become expensive in an audit because the tax office may then estimate. A letter from 2015 can be the decisive evidence in a dispute. Storage is cheap, so nothing is deleted.

The second view says: whoever keeps everything loses the overview and creates new risks. Applications, customer data, and employee records stored indefinitely breach storage limitation. Every additional file is one more affected in a data breach. And in a filing system that is never cleaned up, the one voucher the auditor wants to see is hard to find.

How widespread the uncertainty is shows a survey by Mladinić, Vukić, and Rončević (2023) of 345 small and medium-sized enterprises in Croatia. More than four years after the GDPR took effect, many companies still understood their obligations only insufficiently, and according to the authors implementation was not satisfactory. Small companies often lack staff and money for it. The study concerns one country and relies on self-reports, but the direction is likely transferable.

I consider the second view the more robust one, with the justified core of the first. What has a retention duty stays until the end of the period, and whoever has a reason based on evidence may keep it longer with justification. Everything else is deleted according to a fixed plan. The difference between the two attitudes lies not in caution but in whether the caution is written down.

The one-page retention plan

The practical tool is a table called the retention plan here. It assigns each type of document two dates and a location and connects filing, document control, and data protection. The article on document control distinguishes specifications, which are controlled, from records, which are only kept securely. The retention plan concerns mainly the records.

1. Collect document types

   Go through the filing system and the main programs and note which types of documents are stored there. Ten to twenty types are enough for most small companies.

2. Assign periods

   Assign each type its minimum period and mark whether it contains personal data. Clarify unclear cases with your tax adviser.

3. Set location and responsibility

   Each type has exactly one location and one responsible person, as in the filing charter from the article on digital filing.

4. Set an annual deletion day

   Once a year, for example in January, whatever has expired is deleted and destroyed, after checking for pending proceedings. The date belongs in the compliance calendar.

The annual deletion day is the part most often missing. It fits into the compliance calendar that the article on bureaucracy in mid-sized companies describes as a remedy for self-made effort. For customer data in sales, the article on data protection in sales describes which additional rules apply.

Conclusion: what must be kept and for how long?

The question was
a small company must keep and for how long, and how it organizes retention and deletion. Under German tax and commercial law, three periods apply as of November 2026: ten years for books and annual statements, eight years for accounting vouchers, six years for business letters. The period begins at the end of the year in which the document was created and is extended during ongoing audits and proceedings. Electronic documents stay electronic; for e-invoices, the data set is what counts.

As the two-clock model shows, retention is only half the duty. For personal data, a maximum duration applies at the same time, and whoever keeps everything trades one risk for another. A retention plan with location, period, and responsible person, plus a fixed deletion day, turns both duties into a routine. The sober observation is: a company is not orderly when it has everything, but when it knows why it still has something.

The next step

• List the ten most common types of documents in your company.
• Enter the minimum period, location, and responsible person for each type.
• Mark the types containing personal data and set a deletion date for them.
• Check whether e-invoices are stored in their original format and unalterable.
• Put an annual deletion day in the calendar and clarify open questions with your tax adviser.