Retention periods

Retention periods define how long records must remain available. In Germany the decisive rules come from commercial and tax law: Section 257 of the Commercial Code (HGB) and Section 147 of the Fiscal Code (AO) require ten years for books, inventories, annual financial statements, management reports and opening balance sheets, and six years for commercial and business correspondence received or sent. For accounting vouchers the period was shortened from ten to eight years by the Fourth Bureaucracy Relief Act with effect from 1 January 2025, with a matching reduction for invoices under Section 14b (1) of the VAT Act. Sector-specific duties come on top, for example the payroll account under Section 41 (1) of the Income Tax Act or remuneration records under Section 28f (1) of the Social Code Book IV. Crucially, the clock does not start when the document is created but at the end of the calendar year in which the last entry was made or the voucher arose (Section 257 (5) HGB, Section 147 (4) AO).

From a data protection perspective these duties sit in tension with the storage limitation principle (Art. 5(1)(e) GDPR) and the right to erasure (Art. 17 GDPR). The GDPR resolves the conflict itself: under Art. 17(3)(b) GDPR the duty to erase does not apply where processing is necessary to comply with a legal obligation under Union or Member State law, and continued retention is then based on Art. 6(1)(c) GDPR. The direction of travel matters, however. A retention obligation does not permit continued use of the data for the original operational purpose; it only permits keeping the records for evidentiary purposes. This is why Section 35 (3) of the Federal Data Protection Act (BDSG) substitutes restriction of processing for erasure: the data are blocked, removed from the active working set and made accessible only for the statutory evidence purpose.

Genuine retention obligations must be distinguished from a mere interest in retention. Keeping data until the standard limitation period of three years has expired (Sections 195, 199 of the Civil Code) is not a legal obligation but a legitimate interest under Art. 6(1)(f) GDPR, which requires a documented balancing test. Conversely, the obligation to retain a tax-relevant voucher does not justify keeping the entire customer record in the CRM. In practice this is handled through a deletion concept that defines a deletion rule per data category and system, and through the record of processing activities, which under Art. 30(1)(f) GDPR must state the envisaged time limits for erasure. DIN 66398 has become the established methodology, grouping data types into deletion classes with uniform periods and defined starting points.