Hosting and data
How long must a Dutch company keep its business records?
Short answer
A Dutch company keeps its accounts for seven years, and records about property for ten. That is the tax retention period (set by the Dutch Tax Administration), and it covers digital records too, including business email that holds agreements. Personal data works the other way round: the GDPR says you keep it no longer than needed. A job application goes after four weeks, a staff file usually two years after the person leaves.
Why do two rules seem to contradict each other?
Because they come from two directions. The Dutch Tax Administration (Belastingdienst) wants you to be able to show what happened, so it requires you to keep records. The GDPR (the AVG in the Netherlands) protects the people you hold data about, so it requires you to throw things away.
They clash less than they seem to. The tax rule is a valid reason to keep something, also under the GDPR. It comes down to this: keep what you must keep for as long as you must, and the rest no longer than you need it.
Which periods apply?
These are the periods for a company in the Netherlands.
| What | Period | Where it comes from |
|---|---|---|
| General ledger, debtors, creditors, sales and purchases, stock, payroll records | 7 years | Dutch tax retention period |
| Records about property | 10 years | Dutch tax retention period |
| Wage tax declaration and copy of ID document | 5 years after employment ends | Payroll tax rules |
| Appraisals, meeting notes and the like from the staff file | Guideline: 2 years after employment ends | GDPR |
| Application data of rejected candidates | Guideline: 4 weeks after the process ends, longer only with consent | GDPR |
| Camera footage | Guideline: 4 weeks | GDPR |
This is an overview for the ordinary situation. Some sectors have their own rules, such as healthcare, notaries and lawyers. The periods for the accounts are set by the Tax Administration. For personal data the guidelines come from the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority. Your accountant or lawyer knows the exceptions for your company.
Watch when a period starts. The seven years begin when a document loses its current value. A contract that runs for four years is kept for those four years and then for another seven.
What does that mean for your IT?
This is where it gets practical. The periods are known. The question is whether your systems follow them.
Mailboxes of people who have left. The account is deleted, and with it the last few years of correspondence with customers. This is where companies most often break their retention duty without noticing. Convert such a mailbox into a shared mailbox, or make sure it sits in a backup. See an employee leaving.
The recycle bin is not an archive. In Microsoft 365 a deleted file is gone for good after 93 days. Keeping something for seven years only works with a retention policy or a backup that reaches back that far. We explain the difference in is OneDrive a backup.
Files that must stay readable. A backup of the accounting package from 2020 is worth nothing if the package no longer exists. When you switch, export the accounts to a format you can still open in seven years.
Job applications in everyone’s inbox. A CV goes by email to three colleagues and stays there for years. A separate address for applications, in a shared mailbox that is emptied now and then, fixes that.
How do you set it up?
- Make a list of the kinds of data and write the period and the location next to each. One page is enough.
- Set a retention period for the backup that matches your longest duty. For most companies that is seven years for email and accounts.
- Use retention policies where you can. Microsoft 365 can hold email and documents for a fixed period, even when a user deletes them, and clear them afterwards.
- Agree who clears up. Staff files and applications do not disappear by themselves.
- Test whether you can open something from years back. A retention duty you only meet on paper does not help in an inspection.
With a Microsoft 365 backup we choose the retention period together, and with backup and recovery the same goes for servers and shared folders. What has to be in it, you decide with your accountant. We make sure it is still there in seven years.