Is email archiving mandatory in Germany? Yes – but not for every message. Which emails businesses must keep for six, eight or ten years and what the GoBD require.
August 26, 2026
oneCorp Team
What matters is the content and legal significance of a message: commercial and business letters must be kept for six years, accounting records such as invoices for eight years since 2025. Archiving must be complete, tamper-proof and machine-readable – and once the retention period ends, deletion is part of the job too.
Is email archiving mandatory? The short answer: yes, certain business emails must be retained – but not every single email. What matters is the content of a message and whether it qualifies, for example, as a commercial or business letter, an accounting record or a document relevant for tax purposes.
In Germany, the key requirements come from the German Commercial Code (HGB), the German Fiscal Code (AO) and the GoBD – the Federal Ministry of Finance's principles for the proper keeping and retention of books, records and documents in electronic form and for data access. The EU General Data Protection Regulation (GDPR) applies at the same time. Since 2025, shorter retention periods for accounting records and new rules for e-invoices have also applied.
This guide explains which emails you need to keep and for how long, what the GoBD specifically require and how to put archiving into practice.
Note: This article provides a general overview of the legal situation in Germany. It does not constitute legal or tax advice – oneCorp is an IT service provider and does not advise on legal or tax matters. Most of the linked sources are official German-language publications.
No. There is no blanket obligation to archive every email a company sends or receives. What counts is the content and function of a message.
Under Section 147 AO, businesses must retain, among other things, received commercial or business letters, copies of sent commercial or business letters, accounting records and other documents insofar as they are relevant for taxation. Section 257 HGB requires merchants to keep received commercial letters and copies of sent commercial letters. The law defines the term narrowly: commercial letters are only documents that relate to a commercial transaction. The tax law concept of commercial or business letters is broader.
In other words: it is not the medium of email that triggers the retention obligation, but the business and tax-relevant content of the message.
Emails subject to retention can include messages that document a business transaction or contain information relevant for tax purposes, for example:
It always depends on the specific content. A short message such as “Thank you for your inquiry” does not automatically have to be archived for years. If the same email contains a binding price commitment, an order or a contractual arrangement, things look different.
The GoBD provide some practical relief for invoices sent as attachments: if an email merely serves as a “means of transport” for an attached invoice and contains no other information subject to retention, the email itself does not have to be kept – but the invoice does (GoBD, para. 121).
How long an email must be kept depends on its legal classification:
| Type of document | Period | Legal basis |
|---|---|---|
| Commercial books, inventories, opening balance sheets, annual financial statements, management reports, as well as books and records | 10 years | Section 257(1) no. 1 HGB, Section 147(1) no. 1 AO |
| Accounting records, e.g. invoices | 8 years | Section 257(1) no. 4 HGB, Section 147(1) no. 4 AO, Section 14b UStG |
| Received commercial or business letters and copies of sent letters | 6 years | Section 257(1) nos. 2 and 3 HGB, Section 147(1) nos. 2 and 3 AO |
| Other documents relevant for taxation | 6 years | Section 147(1) no. 5 AO |
The eight-year period for accounting records has applied since January 1, 2025. It was introduced by the Fourth Bureaucracy Relief Act and also covers documents whose previous ten-year period had not yet expired by the end of 2024 (Art. 95 EGHGB). For credit institutions, insurance companies and investment firms, accounting records must still be kept for ten years (Section 257(4) HGB).
The period always begins at the end of the calendar year in which the document was created or the letter was received or sent (Section 257(5) HGB, Section 147(4) AO). For tax purposes, it does not end as long as the assessment period for the taxes concerned is still running (Section 147(3) sentence 5 AO).
Example: An invoice received by email in March 2026 must be kept for eight years as an accounting record. The period begins at the end of 2026 and runs until December 31, 2034 – provided the tax assessment period has expired by then.
Since January 1, 2025, all businesses in Germany must be able to receive electronic invoices; an email inbox is sufficient for this (Federal Ministry of Finance FAQ on e-invoicing). Transitional periods apply to issuing invoices: until the end of 2026, invoices may still be issued on paper or in other electronic formats; until the end of 2027, this only applies to businesses with prior-year turnover of no more than €800,000. From 2028, e-invoicing is generally mandatory for domestic B2B transactions (Section 27(38) UStG). Exemptions from the obligation to issue e-invoices include small-value invoices of up to €250 and businesses under the small business scheme.
What matters for archiving: with an e-invoice, the structured data record is decisive, for example in XRechnung or ZUGFeRD format. It must be kept in the format in which it was received (GoBD, para. 131). Since e-invoices often arrive by email, archiving should capture attachments completely and unchanged.
The GoBD are a circular issued by the German Federal Ministry of Finance on November 28, 2019, amended on March 11, 2024 and most recently on July 14, 2025. They specify how electronic documents must be retained and made available for a tax audit. Three points are particularly important for emails:
In addition, the principle of immutability applies: records must not be altered in such a way that the original content can no longer be determined (Section 146(4) AO, Section 239(3) HGB). Throughout the entire retention period, documents must be available, legible and machine-readable (Section 147(2) AO). How your company ensures this belongs in its procedural documentation.
The term “audit-proof” (German: revisionssicher) is widely used, but it appears neither in the HGB nor in the AO or the GoBD. In practice, it describes archiving that meets the legal requirements: complete, tamper-proof, orderly, retrievable and legible throughout the entire retention period.
Certificates or attestations for archiving software are not binding on the tax authorities either (GoBD, para. 181). What matters is how a solution is set up, operated and documented within your own company.
Many companies use Outlook folders or local archive files to declutter their mailboxes. That makes sense for day-to-day organization. However, it should not be equated with archiving within the meaning of the HGB, AO and GoBD: messages can usually still be deleted or altered there, and completeness is not ensured.
Simply storing emails on the mail server or in Microsoft 365 does not automatically answer the question of whether the requirements for immutability, completeness and availability are met either. That depends on the specific configuration.
Private messages do not become subject to retention simply because they are stored in a business mailbox. However, if a company permits or tolerates private use of business email accounts, additional data protection questions arise.
For a long time, employers in this situation were considered telecommunications providers obliged to observe the secrecy of telecommunications. Since the TTDSG came into force – now the Telecommunications Digital Services Data Protection Act (Section 3 TDDDG) – several German data protection authorities and the Federal Network Agency take the view that employers generally do not provide a telecommunications service in this case. The question has not been conclusively settled; the Federal Labour Court has not yet ruled on it. The GDPR applies in any case.
Companies should therefore regulate private use clearly – for example in a usage policy or a works agreement – and define how private messages are handled in archiving.
The GDPR requires personal data to be stored only for as long as necessary for the respective purpose (Art. 5(1)(e) GDPR). This does not conflict with a statutory retention obligation: the right to erasure does not apply where processing is necessary to comply with a legal obligation (Art. 17(3)(b) GDPR).
Conversely, once the retention period has expired and there is no other reason to keep the data, personal data must be deleted. A good archiving concept therefore covers not only retention but also timely deletion.
| Misconception | The facts |
|---|---|
| Every email must be archived. | What matters is the content and legal significance of the message. |
| Outlook folders are automatically audit-proof. | Regular filing in Outlook does not ensure completeness or immutability. |
| Only received emails must be kept. | Copies of sent commercial and business letters must also be retained. |
| All documents must be kept for ten years. | Since 2025, accounting records generally have to be kept for eight years, commercial and business letters for six. |
| A PDF copy is always sufficient. | Only if the GoBD requirements are met – otherwise both the original and the copy must be kept. |
| Archiving means storing everything indefinitely. | Once retention periods have expired, personal data must generally be deleted. |
A central archiving solution that works independently of individual mailboxes makes implementation much easier. Look out for the following:
Archiving solutions such as MailStore offer these functions. oneCorp, for example, operates MailStore as a managed service in German ISO 27001-certified data centers – including setup and import of existing mailboxes from Microsoft 365, Exchange or IMAP accounts (Email archiving with MailStore).
Archiving software is an important prerequisite, but on its own it does not make a company GoBD- or GDPR-compliant. An IT service provider can supply and operate the right technical platform. Responsibility for complying with retention and data protection obligations, however, remains with the company itself. This includes in particular:
Involve your tax advisor and your data protection officer in these questions, and seek legal advice where legal questions are unclear.
The question “Is email archiving mandatory?” cannot be answered with a simple yes or no. There is no general obligation to archive every email. However, business emails that qualify as commercial or business letters, accounting records or documents relevant for taxation must be kept for six, eight or ten years – complete, unaltered and machine-readable.
Combining these requirements with central archiving, clear retention and deletion rules and procedural documentation creates a solid foundation for tax audits and data protection. A service provider can supply the technology – rules, responsibilities and documentation remain the company's task.
As of October 2026. Legal basis: Section 257 HGB, Section 147 AO, Section 14b UStG and the GoBD as amended on July 14, 2025. This article is for general information only and does not constitute legal or tax advice. For an assessment of your individual situation, please consult your tax or legal advisor and, for data protection matters, your data protection officer.
