Complete
Everything subject to retention is captured, not just what someone happened to think of.
Guide · Email
Email archiving for associations. What is required and what is just sensible.
There are plenty of half-truths about email archiving, from “keep everything for ten years” to “doesn’t apply to associations”. Neither is quite right. This guide sets out the duties that apply in Germany. It is not tax or legal advice: what exactly applies to your association is a question for your tax adviser.
By Paul Czichos, consulting and project support at czichos.net GmbH · Updated
When it is required
Email retention periods. It depends on the content.
German tax and commercial law has no specific email duty. It requires certain documents to be kept. If they arrive by email, the duty applies to the email.
- Business letters, meaning correspondence that prepares, concludes, performs or reverses a transaction: six years (section 147 of the Fiscal Code, section 257 of the Commercial Code).
- Accounting records such as invoices: eight years since the Fourth Bureaucracy Relief Act, previously ten.
- Emails that merely act as an envelope, such as “please find the invoice attached”: the attachment must be kept, the covering message usually not.
The periods start at the end of the calendar year in which the message was received or sent. Charitable associations too must keep proper records, not least to prove their charitable status. How far the duties go depends on whether, and to what extent, your association is required to keep books, for example because of commercial activities.
What the GoBD require
What the GoBD require for emails. Five requirements for retention.
The GoBD, the German tax authorities’ principles for keeping books, records and documents in electronic form, describe how electronic records must be retained.
Unalterable
Later changes are impossible or recorded in a traceable way.
In the original
Documents received electronically are kept electronically. A printout does not replace the original.
Searchable and readable
Throughout the retention period you must be able to find, read and machine-analyse the records, even after switching software.
Documented
A process documentation describes how records are captured, retained and retrieved.
Archiving and GDPR
Email archiving and the GDPR. Keep and delete, each at the right time.
The GDPR requires that personal data is not stored longer than necessary. This is compatible with a retention duty: as long as a legal obligation exists, storage is permitted; afterwards the data must be deleted.
An archive therefore needs clear retention periods, deletion when they expire and restricted, logged access. Not everyone who writes emails needs to be able to search the archive. The other duties are covered in the guide to the GDPR for associations. The same questions arise for enquiries from your contact form.
Private use of work mailboxes is a tricky area. If it is permitted, archiving becomes considerably harder legally. Many organisations therefore state explicitly that work mailboxes are for work only. Clarify this with your data protection officer.
Do it yourself or have it done
Running a mail archive yourself? Not every association needs a mail archive.
If the documents you must keep end up properly in your accounts anyway, orderly record-keeping may be enough. A dedicated archive pays off when a lot of business is done by email.
Handle it yourself
If little business is done by email
- File records where they belongMove invoices from emails into your accounts or a document system in their original form, instead of leaving them in the mailbox.
- Piler, open sourceA free mail archive you run yourself. No licence fees, but it needs a server, backups and someone to look after it.
- Talk to your tax adviserAn hour’s advice clarifies what your association actually has to keep.
Have it done
If many mailboxes and branches are involved
- Lots of business correspondenceIf contracts, quotes and grant decisions arrive by email, they should be archived automatically and completely.
- Access with a reasonAnyone searching the archive gives a reason and confirms it. Every access is recorded.
- Periods that expire by themselvesDeletion at the end of the period, without anyone having to remember.
On our own behalf: we earn money from the second column. If hardly any business is done by email in your association and records end up properly in your accounts, you don’t need a mail archive of your own.
Common questions
Email archiving FAQ. What associations ask.
Does an association have to archive emails?
Not every email. Emails that count as business letters or accounting records must be kept. Charitable associations too must keep proper records. How far this goes for your association is a question for your tax adviser.
How long must emails be kept?
In Germany, business letters for six years and accounting records such as invoices for eight years. The period starts at the end of the calendar year in which the message was received or sent.
Is it enough to print important emails to PDF?
For documents received electronically that must be kept, usually not. The GoBD require retention in the original format, so the records remain machine-readable.
Does archiving conflict with the GDPR?
No, as long as a legal retention duty exists. Once the period expires, the data must be deleted. A good archive therefore sets periods and deletes automatically afterwards.
Archive and approvals with secMail
secMail’s archive keeps messages for as long as the law or your own rules require and makes them searchable. Anyone who wants to look inside states a reason and confirms by text message. Access is time-limited and logged. Deletion happens only when the period expires, never by hand.
Questions about mail archiving? Let’s talk.
Tell us how many mailboxes you have and what happens to old messages today. We will tell you what makes sense technically. The tax question is one for your tax adviser.
No obligation and no contract. We usually reply within one working day. secMail is priced according to your mail setup, on request.
Prefer to reach us directly? Send an email · call 030 994048000