Email Archiving: Obligations, Periods and GoBD

Definition: Email archiving means keeping business emails complete, unchanged and findable, separately from the mailbox. In Germany this is required by law for many messages. The basis is the Commercial Code (HGB), the Fiscal Code (AO) and the GoBD, the tax authorities' rules for electronic records.

A quote, an order confirmation, an invoice as a PDF: a large part of business correspondence now happens by email. The same retention obligations apply to these documents as to paper. Anyone who just leaves them in the mailbox risks trouble in a tax audit or a legal dispute.

Which emails have to be archived?

Commercial and business letters: Emails that prepare, conclude, carry out or reverse a business transaction, such as quotes, orders, confirmations and complaints.
Tax-relevant documents: Invoices and other accounting records received or sent by email. If the email only serves to transport the attachment and contains no other information that must be kept, the GoBD only require the attachment to be kept, not the email itself.
Not required: Advertising, spam, private mail and simple scheduling without business content.

In practice, drawing the line case by case is difficult. Many companies therefore archive all business email and exclude only clearly irrelevant messages.

Retention periods in Germany

Type of email	Period	Basis
Commercial and business letters	6 years	Section 257 HGB, Section 147 AO
Accounting records, e.g. invoices	8 years	Section 257 HGB, Section 147 AO

For business letters, the period starts at the end of the calendar year in which the email was received or sent. For accounting records, what counts is the end of the year in which the record was created (Section 257 (5) HGB). Additional rules apply in some industries. Your tax adviser can best tell you which periods apply to your company.

What the GoBD require

The GoBD are the German tax authorities' principles for electronic books and records. For archived email, they mean above all:

Complete: No relevant message may be missing.
Unalterable: Messages may not be changed afterwards or deleted unnoticed.
Findable and readable: They must be findable throughout the period and readable within a reasonable time.
In the original format: An email must be kept as it was received. A printout or a PDF of the email is not enough.
Traceable: Process documentation describes how archiving works and who has access.

These requirements are often summed up as "audit-proof".

Why a mailbox is not an archive

Users can delete or move messages.
Mailboxes have size limits, so old messages end up in local files.
When someone leaves the company, their mailbox is often deleted.
Searching all mailboxes over many years is hardly possible.

An archive, by contrast, stores a copy of every message separately from the mailbox and protects it until the period ends.

Email archiving and the GDPR

The retention obligation is a legal basis for storing personal data. At the same time, the GDPR requires that data is not kept longer than necessary. A good archive resolves this conflict as follows:

It deletes messages itself once the period ends.
It lets you lock individual messages against deletion when needed (legal hold), for example in a legal dispute.
It restricts access to authorized people and logs it.

If private use of work mailboxes is allowed, the archive may also capture private mail. That needs clear rules, for example in a works agreement.

What to look for in an email archive

Automatic: Messages are archived on arrival and sending, not only when someone remembers.
Retention rules: Periods can be set, and expired messages are deleted automatically.
Legal hold: Individual messages can be locked against deletion.
Search and export: Search by sender, recipient, subject and time range, and export of the original message.
Storage location: Where are the copies kept, and who has access?

The mail archive in the SecTepe Mail Security Gateway

The mail archive in the SecTepe Mail Security Gateway stores a copy of every scanned message. You choose whether inbound, outbound or all messages are archived. Retention is set to around seven years by default and can be adjusted, for example to eight years for invoices. After that, the gateway deletes the copies itself. In the archive you search by sender, recipient, subject, direction, scan result and time range, and download the original message. Legal hold locks individual messages against deletion. The archive is off by default.

Conclusion

Business emails are subject to the same retention obligations as paper mail: in Germany generally six years for business letters and eight years for invoices. A mailbox is not enough for this. An archive keeps messages complete and unchanged, makes them findable and deletes them once the period ends. Clarify the exact periods for your company with your tax adviser.

FAQ about Email Archiving

Is email archiving mandatory?

For many business emails, yes. Companies in Germany must keep commercial and business letters as well as tax-relevant documents. That also applies when they arrive or are sent by email. Private mail and advertising are not covered.

How long do emails have to be kept?

In Germany, commercial and business letters are generally kept for six years, and accounting records such as invoices for eight years. For business letters, the period starts at the end of the year in which the email was received or sent; for accounting records, at the end of the year in which the record was created. Clarify which periods apply to you with your tax adviser.

What does audit-proof email archiving mean?

Audit-proof means the emails are complete, unchanged, always findable and readable, and every access can be traced. That is what the German GoBD require for tax-relevant documents. A mailbox or a PST file usually does not meet these requirements.

Is it enough to leave emails in the mailbox?

Usually not. In a mailbox, messages can be deleted or changed, and searching across years is hard. An archive stores a copy separately from the mailbox and prevents deletion before the retention period ends.

How does email archiving fit with the GDPR?

The retention obligation is a legal basis for storing the data. Once the period ends, however, personal data must be deleted. An archive should therefore delete automatically after the period and restrict access to authorized people.

What applies if employees may use email privately?

Then it gets tricky, because the archive may also capture private mail. Many companies therefore prohibit private use of work mailboxes or regulate it in a works agreement. Get legal advice on this.

More terms in “Compliance & Regulation”

All terms in “Compliance & Regulation” →