How long email has to be kept, and how

The four regimes compared

When several apply at once

A Zurich company with customers in Germany is subject to the Swiss Code of Obligations, to the GDPR for its personal data from the EU, and may have a US subsidiary. For each message, the longest period that applies to it governs.

The apparent conflict between keeping and erasing is resolved in the law itself: Art. 17(3) GDPR exempts data from the right to erasure as long as a legal obligation requires it to be kept or it is needed for legal claims. What no duty holds any longer is erased, and only then.

And Austria?

MailVault does not model Austria as a regime of its own, but the requirements are close. Under § 132 BAO and § 212 UGB, books, records, vouchers and business papers are kept for seven years. The period runs from the end of the calendar year the booking or voucher relates to; with a financial year that differs from the calendar year, from the end of the calendar year in which the financial year ends. Records concerning real estate are kept longer, and while tax or court proceedings are pending, records have to be kept even after the period has run out.

Electronic retention is allowed if the reproduction is complete, orderly, identical in content and true to the original, and stays possible at any time for the whole period. In MailVault a retention class of seven years can be added for this; the classes that ship with it count ten.

Which emails are affected

Not every email has to be kept, but far more than people expect:

• Emails that serve as vouchers – an invoice received by email, an order confirmation, a credit note – are accounting vouchers. In Switzerland they are kept for ten years, in Germany for eight since 2025.
• Commercial letters – anything that prepares, concludes, carries out or reverses a transaction – are kept for six years in Germany.
• Pure information, newsletters, private messages and spam carry no retention duty. They usually land in the same mailboxes, though, and separating them message by message is laborious.

In practice many organisations archive their business mailboxes in full and use rules to assign individual messages to a shorter or longer retention class.

Why a mailbox is not an archive

A mailbox at Microsoft 365, Google or a hosting provider does not meet these requirements by itself. Every message in it can be changed, moved and deleted by the people involved without any record; archived and current mail are not separated; and what remains after a change of provider is up to the provider. An archive is a separate store that guarantees the opposite: complete, unchanged, findable and readable for as long as the period runs.

What software can contribute, and what it cannot

A great deal can be ensured technically: that a change is noticed, that the time is confirmed from outside, that everything can be found and handed over, that nothing disappears before its period ends. Another part is organisational and stays that way: who is responsible, how the procedure is documented, where the second copy lives, who signs the control. MailVault shows these points as open until they are done, rather than showing them as met.