Skip to content 
Aufbewahrungsfrist
Before old servers, archive drives or laptops are erased, a mandatory question arises: do they hold documents that you still have to retain? Retention periods and erasure obligations belong together. This entry explains the most important periods and what they mean for IT retirement.
In brief
A retention period is the legally prescribed period during which a company must keep certain documents unaltered and legible, such as accounting vouchers, annual financial statements or business letters. The most important periods derive from the German Commercial Code (HGB) and the German Fiscal Code (AO). Before retired data carriers are erased, it must be established that data subject to retention is secured elsewhere.
Which retention periods apply?
The central rules are in § 257 HGB and § 147 AO. With the Fourth Bureaucracy Relief Act, the period for accounting vouchers was shortened from ten to eight years. The new period applies to all vouchers whose retention period had not yet expired on 1 January 2025.
| Documents | Period (as of 10/2026) |
|---|---|
| Commercial books, inventories, annual financial statements, management reports, opening balance sheets, work instructions and organizational documents | 10 years |
| Accounting vouchers, for example invoices and bank statements | 8 years |
| Received commercial and business letters, copies of business letters sent, other documents relevant for tax purposes | 6 years |
Different rules apply to some industries, such as credit institutions, insurers and securities firms. Further periods may arise from employment and social law or from industry regulations.
When does the period begin and end?
The period begins at the end of the calendar year in which the last entry was made or the document was created or received. An invoice from June 2026 must therefore be retained for eight years from 1 January 2027. The period does not expire as long as the documents are relevant for taxes whose assessment period is still running, for example because of a tax audit.
Documents created electronically must, under the GoBD be kept electronically and in machine-readable form. A printout is then not sufficient.
Retention and data protection: two sides of the same coin
The GDPR requires that personal data be stored only as long as necessary for the purpose. A statutory retention period is such a purpose. Once it has expired, the reason lapses and the data must be erased. An Erasure concept sets for each type of data an Standard erasure period . How to build such a policy is described by the standard DIN 66398.
Rule of thumb: archive first, then erase. Anyone who destroys data subject to retention together with the old device loses it – and anyone who keeps it too long violates data protection.
What this means for IT retirement
- Check in advance: Which systems contain accounting, personnel or contract data? This applies especially to servers, NAS systems and backup media.
- Transfer data: Data subject to retention is migrated to the new system or an archive before the old device is erased.
- Document the erasure: Only then is the data carrier erased or destroyed in a certified manner. The erasure certificate documents the step.
- Document the disposal: The asset disposal itself also generates documents that must be retained. More on this in the guide IT scrapping report.
What counts in a data protection audit when disposing of data carriers is explained in our guide Disposing of data carriers under the GDPR. This entry does not replace legal or tax advice.
Retention periods and Second IT
Second IT takes over the last step: after you have secured your data, the devices are erased in a certified manner with Blancco, with an erasure report per serial number. Data carriers that cannot be erased are destroyed in-house according to DIN 66399 (up to security level H-5 and E-5). More on Data security at Second IT.
Frequently asked questions about retention periods
Does a period of eight or ten years now apply to invoices?
Invoices are accounting vouchers. Since 2025, a period of eight years generally applies to them, provided the old period was still running on 1 January 2025. Special rules apply to some financial industries. If in doubt, clarify with your tax advisor.
May I erase an old accounting system after the changeover?
Only when the data subject to retention has been secured in a form that complies with the GoBD, that is, complete, unaltered and machine-readable. After that the data carrier can be erased in a certified manner.
Do I have to erase data after the period has expired?
For personal data, as a rule yes, if there is no other reason for storage. This follows from the GDPR principle of storage limitation. Therefore set erasure periods in your erasure policy.
Is a scan enough if I have to retain paper documents?
Under conditions, yes. Paper documents may be scanned if the procedure complies with the GoBD and the scan is complete, legible and unalterable. Documents created electronically, by contrast, may not simply be printed out. Clarify the procedure with your tax advisor.
Which data on old servers is subject to retention?
Above all accounting data, invoices, annual financial statements and business letters. Personnel and contract data can also be subject to periods. Therefore check servers, NAS systems and backup media before you erase, and secure this data first.
Data secured? Then we erase demonstrably – with a report per serial number.
Send us your device list. You will receive your offer in 48 hours on average.