Email Archiving Requirements Across the EU: A Country-by-Country Overview

There is no single European Union regulation that specifies exactly how long businesses must retain email. What exists instead is a dense web of national tax codes, commercial laws, accounting regulations, and sector-specific rules that collectively determine your archiving obligations, and they vary considerably from one country to the next.

For multinationals, compliance officers, and legal teams supporting operations across Europe, understanding your obligations requires country-level knowledge. A retention period that satisfies German tax law will leave you short in France. A system that meets Dutch requirements may not satisfy Italy's technical standards for digital conservation. And all of it operates under the GDPR, which simultaneously demands you do not keep personal data longer than necessary.

This article provides a structured, jurisdiction-by-jurisdiction reference for email archiving obligations in Germany, France, the Netherlands, Italy, Spain, Austria, Switzerland, and the United Kingdom.

Comparison Table: Email Retention Requirements by Country

All periods are minimum retention durations measured from the end of the fiscal year in which the document originated, unless otherwise noted.

Germany: GoBD Sets the Technical Standard

Germany has some of the most technically prescriptive email archiving rules in Europe. Three instruments work together: the HGB (Handelsgesetzbuch), the AO (Abgabenordnung), and the GoBD administrative principles.

HGB §257 requires merchants to retain commercial correspondence (including business emails) for 6 years. Accounting vouchers, including invoices, must be retained for 8 years (since 1 January 2025), books and annual financial statements for 10 years.

AO §147 mirrors these periods for all tax-relevant records. Any email that touches a tax obligation (an invoice, a delivery confirmation tied to a VAT transaction, a contract) falls under this rule.

GoBD (Grundsätze zur ordnungsmäßigen Führung und Aufbewahrung von Büchern, Aufzeichnungen und Unterlagen in elektronischer Form) is issued by the Federal Ministry of Finance and defines how electronic records, including emails, must be managed. The core requirements are:

• Immutability: Archived emails must not be altered after storage. The original message must be preserved exactly as sent or received, including headers.
• Completeness: All tax-relevant correspondence must be captured without gaps.
• Traceability: Every access, modification attempt, or deletion must be logged.
• Machine readability: Archived data must remain accessible and searchable throughout the retention period.
• Timeliness: Emails with tax relevance must be archived promptly, not batched weeks later.

GoBD also requires a Verfahrensdokumentation, a process documentation that describes how your archiving system works, how data flows in, how access is controlled, and how integrity is ensured. This documentation must be kept current and must itself be archived.

The practical consequence for businesses: a simple email backup stored on a file server does not satisfy GoBD. You need a dedicated archiving system with write-once storage, audit logging, and a documented procedure.

Non-compliance carries serious risk. Where records are missing or incomplete, German tax authorities (Finanzamt) are entitled to estimate taxable income, typically in the state's favour. In severe cases, incomplete records can be treated as a sign of wilful tax evasion.

France: Long Commercial Retention, Shorter Tax Window

France draws a clear distinction between commercial document retention and tax record retention, and the periods run in opposite directions compared to Germany.

Code de Commerce Art. L123-22 requires businesses to retain commercial correspondence for 10 years from the close of the fiscal year. This is one of the longest general commercial retention periods in Europe, and it explicitly covers correspondence, which French courts and regulators have consistently interpreted to include email.

LPF Art. L102B (Livre des Procédures Fiscales) governs tax document retention and sets the period at 6 years from the year in which the tax was assessed or the declaration was filed. This is shorter than the commercial requirement. For email you should plan around the 10-year commercial period to avoid gaps.

There is no French equivalent of GoBD specifying technical archiving standards in detail for general businesses. However, the rules for electronic invoices (factures électroniques) are considerably more prescriptive, and France's mandatory e-invoicing rollout, which began for large enterprises in 2024 and extends to SMEs through 2026, introduces digital integrity requirements that will affect how finance-related email is handled in practice.

French data protection law (enforced by the CNIL) applies the GDPR storage limitation principle strictly. Businesses that retain personal data in archived emails beyond the statutory retention period face regulatory scrutiny. A clear retention and deletion policy, applied automatically by your archiving system, is strongly advisable.

Netherlands: Strong DPA Enforcement Raises the Stakes

The Netherlands applies a 7-year general retention period for business records under AWR Art. 52 (Algemene Wet inzake Rijksbelastingen), the General Tax Act. This covers the administration of any entity subject to Dutch tax law, including emails that form part of the business administration.

For records relating to immovable property, the retention period extends to 10 years, reflecting the longer VAT adjustment periods applicable to real estate.

There are no Dutch-specific technical standards equivalent to GoBD for general businesses, but the Dutch Tax Authority (Belastingdienst) has published guidance making clear that electronic records, including email, must be stored in a form that remains accessible and readable for the full retention period, and that the integrity of those records must be verifiable.

What distinguishes the Netherlands is the aggressiveness of its data protection enforcement. The Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, is among the most active supervisory authorities in the EU. It has taken enforcement action against organisations that retained personal data beyond their stated purposes, and email archives are an obvious area of exposure. Businesses operating in the Netherlands should implement automated deletion rules that purge archived emails containing personal data as soon as the applicable retention period expires.

The combination of a 7-year retention floor and strict DPA enforcement means that indefinite email retention is a compliance liability in the Netherlands. Your archiving system needs to enforce retention windows as firmly as it enforces retention itself.

Italy: Technical Requirements Are the Distinguishing Feature

Italy's retention period of 10 years under Art. 2220 of the Codice Civile is not unusual by European standards. What makes Italy distinctive is the technical framework that applies to electronically stored documents, including emails.

Italian law recognises a specific category of legally valid digital storage called conservazione a norma (conservation according to the norm), defined by the AgID (Agenzia per l'Italia Digitale) technical rules. Documents stored in conformity with these rules carry legal evidentiary value equivalent to paper originals. The requirements include:

• Digital signatures or electronic seals applied to archived documents to ensure authenticity.
• Qualified timestamps attached to batches of documents at the time of archiving, providing legally recognised proof of when documents were stored.
• A Conservation Manager (Responsabile della Conservazione): a designated person or service provider responsible for overseeing the conservation process and certifying its compliance.
• Periodic closure of the conservation package, typically annual, after which the package is sealed and timestamped.

PEC (Posta Elettronica Certificata) is Italy's certified email system. PEC messages carry legal weight equivalent to registered mail and generate receipts that are legally binding. Any PEC correspondence that falls within the scope of business activity must be retained for 10 years. The PEC provider logs metadata, but you are responsible for archiving the full message content and receipts.

For multinational organisations with Italian operations, the conservazione a norma requirements are the most operationally complex obligation in this overview. If your archiving solution does not support digital signature and timestamp workflows, or if it cannot integrate with a qualified Italian conservation service provider, you are likely not meeting Italian law for electronic documents.

Spain: Shorter Retention, but E-Invoicing Pressure Ahead

Spain sets a 6-year general retention period for business documents under Art. 30 of the Codigo de Comercio (Commercial Code). Tax records fall under LGT Art. 66 (Ley General Tributaria), which specifies a 4-year statute of limitations for tax authority assessments. In practice, 4 years is the minimum for tax documents, though maintaining records for the full 6-year commercial period is the safer approach.

Spain does not have a GoBD-equivalent set of technical standards for email archiving. However, the technical picture is about to shift significantly.

Veri*factu, Spain's mandatory e-invoicing and invoice traceability system, is being rolled out from 2027. It requires businesses to use certified invoicing software that transmits invoice data to the AEAT (Agencia Estatal de Administración Tributaria) in real time or near-real time, and that creates a tamper-evident chain of invoice records. While Veri*factu targets invoicing software specifically, it signals the direction of Spanish regulatory expectations for financial record integrity, and organisations that use email to send or receive invoices will need to ensure their archiving practices are compatible with the traceability requirements.

The Spanish DPA (AEPD) takes an active enforcement stance. As with the Netherlands, indefinite retention of personal data in email archives is a risk area.

Austria: Close to Germany, but Without GoBD

Austria's legal framework for business document retention is closely aligned with Germany's in terms of retention periods, but lacks an equivalent to GoBD's technical prescriptions.

UGB §212 (Unternehmensgesetzbuch, the Austrian Commercial Code) requires businesses to retain accounting records and commercial correspondence for 7 years. BAO §132 (Bundesabgabenordnung, the Federal Tax Code) sets the same 7-year period for tax-related records.

The major exception is VAT records for real estate. Under §18(10) UStG (Umsatzsteuergesetz), documents relating to real property that was subject to VAT can be required for up to 22 years. This is the longest retention obligation in this overview and a significant compliance consideration for businesses with Austrian real estate transactions.

Austria has not published a comprehensive administrative guideline comparable to GoBD. The Austrian tax authority (Finanzamt Austria) expects that electronic records are stored in a format that preserves integrity and readability, and auditors will examine whether your system allows them to access and search records during a tax audit. In practice, businesses with cross-border German-Austrian operations often apply GoBD standards to their Austrian records as well. This is defensible and avoids maintaining two different systems.

The Austrian Data Protection Authority (DSB) enforces GDPR rigorously. Retention periods must be defined, documented, and enforced. Retaining personal data in email archives beyond the statutory period without a documented legal basis is an enforcement risk.

Switzerland: The WORM Requirement and Long Retention Periods

Switzerland is not an EU member state, but it is a significant jurisdiction for European multinationals. Swiss retention obligations are among the strictest on this list, both in duration and in technical requirements.

Art. 958f of the OR (Obligationenrecht, the Swiss Code of Obligations) requires businesses to retain accounting records, including all business correspondence, for 10 years from the end of the fiscal year. This applies to all entities required to maintain accounts under Swiss law. The technical requirements are set by GeBuV (Geschäftsbücherverordnung, the Business Records Ordinance). Art. 9 of the GeBuV imposes a WORM (Write Once, Read Many) requirement: electronic records must be stored on media or in systems where the stored data cannot be altered or deleted. This is one of the few jurisdictions in this overview where WORM storage is explicitly required by law, rather than merely implied by integrity obligations.

Additional Swiss-specific points:

• VAT records for real estate must be retained for 20 years under Swiss VAT law (MWSTG), reflecting the long adjustment periods for immovable property.
• Criminal penalties apply for violations. Art. 166 of the Swiss Criminal Code (StGB) covers inadequate bookkeeping and can result in custodial sentences. Art. 325 StGB covers violations of record-keeping obligations. These are not merely administrative sanctions.
• The nFADP (new Federal Act on Data Protection), which came into force in September 2023, aligns Swiss data protection law more closely with GDPR principles, including the principle that personal data must not be retained longer than necessary.

For organisations hosting data for Swiss entities, the WORM requirement means that a standard backup solution or a cloud archive without write-protection guarantees does not satisfy Swiss law. Your archiving system must provide verifiable, immutable storage.

The GDPR Thread Running Through All of It

Every jurisdiction covered in this article is either an EU member state subject to the GDPR, or (in the case of Switzerland and the UK) has data protection law substantially equivalent to the GDPR.

The GDPR's storage limitation principle (Art. 5(1)(e)) requires that personal data be kept no longer than necessary for the purpose for which it was collected. Email archives contain personal data. This creates a structural tension: tax and commercial law requires you to retain records for 6, 7, or 10 years, while the GDPR requires you not to retain personal data indefinitely.

The resolution is not to choose one over the other but to implement both simultaneously:

• Retain emails for the full statutory period required by the applicable national law.
• Delete emails automatically when the retention period expires; do not keep archives indefinitely.
• Document your retention policy: what categories of email are retained, for how long, under which legal basis, and how deletion is enforced.
• Restrict access to archived emails so that personal data in the archive is not processed beyond the original archiving purpose.

Supervisory authorities in the Netherlands, Austria, France, and Germany have each taken enforcement positions on excessive retention in email archives. The risk is not hypothetical.

A well-configured archiving system will apply retention rules per jurisdiction, enforce deletion on schedule, and produce the documentation that regulators expect to see.

Operating Across Multiple Jurisdictions

For organisations with entities in several of the countries covered here, the practical challenge is not understanding any single country's rules but maintaining a coherent, auditable system that satisfies all of them simultaneously.

A few principles help:

Apply the longest applicable period as a floor. Where an email relates to a transaction in France (10 years commercial), you need to retain it for 10 years regardless of whether the sending entity is Spanish (6 years). The document's legal significance determines the applicable rule.

Meet the strictest technical standard. Switzerland's WORM requirement and Italy's conservazione a norma requirements are more demanding than the technical standards in other jurisdictions. Building your archiving infrastructure to meet the strictest requirement typically means it also meets the lesser ones.

Automate retention and deletion. Manual compliance does not scale across jurisdictions. Your archiving system must be able to apply different retention periods to different categories of email and delete reliably when those periods expire.

Document everything. Germany requires a Verfahrensdokumentation. Italy requires a Conservation Manager and documented procedures. Regulators in every jurisdiction will ask how your system works. Maintain process documentation and keep it current.

How EasyMailArchive Supports Multi-Jurisdiction Compliance

EasyMailArchive is designed for organisations that face overlapping obligations across multiple European jurisdictions.

The platform provides tamper-proof, immutable storage that satisfies WORM requirements, configurable retention policies by domain, user, or category, automated deletion when retention periods expire, complete audit logs of every access and administrative action, and infrastructure hosted within the EU.

Whether your compliance obligation is Germany's GoBD, Switzerland's GeBuV WORM requirement, Italy's conservazione a norma framework, or simply ensuring that your retention and deletion policies satisfy the GDPR in every jurisdiction where you operate, EasyMailArchive gives your compliance and legal teams a single system they can rely on.

Start your free trial to see how EasyMailArchive fits your organisation's compliance requirements.