Is email archiving mandatory? The short answer is: Yes, certain business emails must be retained -but not every single email.
Veröffentlicht am 1. September 2026 | Lesezeit: 6 Minuten
Entscheidend sind Inhalt und rechtliche Bedeutung einer Nachricht. Handels- und Geschäftsbriefe, Buchungsbelege oder steuerlich relevante E-Mails können gesetzlichen Aufbewahrungspflichten unterliegen. Dabei müssen Unternehmen gleichzeitig Anforderungen an GoBD-konforme Aufbewahrung und den Datenschutz berücksichtigen.
Is email archiving mandatory? The short answer is: Yes, certain business emails must be retained—but not every single one. The deciding factor is the content of the message and whether it qualifies, for example, as a commercial or business letter, an accounting voucher, or a tax-relevant document.
For companies, the most important requirements stem primarily from the German Commercial Code (HGB), the Fiscal Code (AO), and the GoBD. At the same time, archiving must comply with GDPR requirements and the protection of personal data.
But which emails actually need to be archived? How long must archived emails be stored? And is it enough to simply keep messages in Microsoft Outlook or on the mail server?
There is no blanket requirement to archive every single email in a company. The obligation to archive emails depends instead on the content and function of a message.
According to Section 147 of the Fiscal Code (AO), companies must retain, among other things, received commercial or business letters, copies of sent commercial or business letters, accounting vouchers, and other documents that are relevant for tax purposes.
Section 257 of the German Commercial Code (HGB) also obligates merchants to retain certain documents. This includes, in particular, received commercial letters and copies of sent commercial letters. A commercial letter is defined as any document that relates to a commercial transaction.
This means: It is not the medium of email itself that triggers the retention obligation, but rather the business and legal content of the message.
Relevant emails can include, for example, messages that document a business transaction or contain information relevant to taxation.
These include, among others:
It always comes down to the specific content. A brief message such as "Thank you for your inquiry" does not automatically need to be archived for years. However, if that same email contains a binding price quote, an order, or a relevant contractual agreement, the situation may be different.
The German Commercial Code (HGB) and the Fiscal Code (AO) form the central basis for record-keeping requirements.
Under Section 257 of the HGB, business correspondence must generally be kept for six years. Longer periods apply to certain other documents, particularly commercial ledgers and annual financial statements. Under current regulations, accounting vouchers must generally be kept for eight years.
Section 147 of the AO also distinguishes between different types of documents and specifies varying retention periods depending on the category. The books, records, and specific documents mentioned therein generally require a ten-year retention period, while accounting vouchers require eight years and other specified documents require six years.
The specific retention period should therefore not be determined solely by the fact that a document is an email. The decisive factor is the legal classification of the individual document.
The GoBD—principles for the proper management and storage of books, records, and documents in electronic form, as well as for data access—are particularly important for companies.
The GoBD contain requirements for how electronic documents must be stored and made available for future audits. The Federal Ministry of Finance most recently updated the GoBD in 2024 and 2025, among other times.
For electronic commercial or business correspondence and accounting vouchers, it is particularly important that they are generally stored in the format in which they were received. Conversion, for example from MSG to PDF, may be permissible under certain conditions, provided that machine readability is not restricted and the content remains unchanged.
Simply storing emails in an inbox is therefore not automatically the same as audit-proof archiving.
Audit-proof email archiving involves storing electronic messages in such a way that they remain available, readable, and traceable throughout the mandatory retention period.
A suitable solution should, in particular, ensure that archived emails cannot be altered or deleted unnoticed and that they can be quickly retrieved when needed.
This is what distinguishes professional archiving from simply moving a message into an Outlook folder.
The use of an additional archive system should also be embedded in a transparent organizational process. The GoBD impose not only technical but also organizational requirements on electronic record-keeping.
Many companies use Microsoft Outlook to manage and archive messages. While this can be useful for day-to-day email organization, an Outlook folder or a personal archive file should not automatically be equated with legally compliant archiving.
If an email is subject to statutory retention requirements, the chosen solution must meet the corresponding standards for availability, traceability, and protection against unauthorized alteration.
Storing emails on mail servers alone does not, therefore, answer the question of whether audit-proof email archiving has been implemented.
A common misconception is that if a company is required to archive all emails, private emails must also be stored.
That is not the case.
The private use of business email accounts raises additional data protection and organizational issues. Private emails are not subject to retention requirements simply because they were sent or received via a business email address.
In principle, the opposite is true: just because a message is in a business inbox does not automatically make it a business document subject to retention requirements.
Companies should therefore establish clear rules regarding private use, business communication, and automatic archiving.
At first glance, retention requirements and data protection may seem to conflict. The GDPR requires, among other things, storage limitation: personal data should generally only be stored for as long as is necessary for the respective purposes.
However, this does not mean that personal data in a legally mandated archive must be automatically deleted.
Instead, companies must reconcile various legal requirements. For example, an email may contain personal data while also being subject to retention requirements under commercial or tax law.
Therefore, appropriate technical and organizational measures, as well as a transparent deletion and archiving concept, are essential.
Myth 1: Every email must be archived.
No. The content and legal significance of the message are what matter.
Myth 2: Outlook folders are automatically audit-proof.
Standard filing in Outlook does not automatically replace legally compliant archiving.
Myth 3: Only received emails must be kept.
Sent commercial or business letters can also fall under retention requirements. Section 257 of the German Commercial Code (HGB) explicitly mentions copies of sent commercial letters.
Myth 4: Private emails must also be archived.
Private messages are not subject to retention requirements solely based on where they are stored.
Myth 5: A PDF copy is always sufficient.
Not necessarily. For electronic commercial or business letters and accounting vouchers, requirements regarding format, content, and machine readability must be observed.
Myth 5: A PDF copy is always sufficient.
Not necessarily. For electronic commercial or business letters and accounting vouchers, requirements regarding format, content, and machine readability must be observed.
Myth 6: Email archiving simply means storing all messages indefinitely.
That is also incorrect. Retention obligations and data protection must be considered together.
The question "Is email archiving mandatory?" cannot be answered with a simple yes or no. There is no general obligation to archive every single email. However, certain business emails must be retained due to the German Commercial Code (HGB), the Fiscal Code (AO), and tax law requirements.
Emails that qualify as commercial or business letters, document accounting transactions, or are relevant for taxation are particularly important. The GoBD also play a central role in electronic retention.
Companies should therefore determine which relevant emails must be archived, which retention periods apply, and how audit-proof archiving can be implemented both technically and organizationally.
Professional email archiving should not only enable storage but also ensure long-term availability, traceability, and controlled access. At the same time, personal data and GDPR requirements must be taken into account.
Those who integrate these points into a clear archiving concept early on reduce the risk of losing important business documents and create a solid foundation for proper digital document management.
