# Bank records: retention and deletion decision

Version: 11 September 2026

## Identify the record class

Legal entity: [enter]  
Record / data class: [enter]  
Content and purpose: [enter]  
Authoritative system and other copies: [enter]  
Business owner: [enter]

## Map the rules

| Legal provision | Relevant records | Period | Starting trigger | Transitional rule | Decision |
|---|---|---|---|---|---|
| [enter] | [enter] | [enter] | [enter] | [enter] | [enter] |

Checks for German bank records:

- HGB section 257: books and financial statements ten years; business correspondence six years. Accounting vouchers of the institutions listed in paragraph 4, second sentence, require ten years; do not simply apply the general eight-year period.
- AO section 147: assess tax records and unexpired tax-assessment periods separately.
- GwG section 8: generally five years, subject to longer statutory requirements; check the statutory destruction limit and specific starting event.
- Other data: assess necessity for the purpose and legal basis. Storage location alone does not establish a retention period.

## Calculate the date

Triggering event: [description and date]  
Statutory start: [date / year-end]  
Standard expiry: [date]  
Earliest deletion: [date, before assessing additional duties and holds]

## Decide exceptions and conflicts

| Reason / hold | Specific legal basis | Affected records | Decision | Owner | Review date |
|---|---|---|---|---|---|
| [enter] | [enter] | [enter] | [enter] | [enter] | [date] |

Resolve overlapping obligations substantively. Where statutory maximum periods apply, do not merely select the latest calculated date. Retention does not authorise unrestricted reuse. Apply GDPR Article 18 only when its own conditions are satisfied.

## Evidence implementation

- Permitted archive access and purposes: [enter]
- Deletion method for each system and copy: [enter]
- Backups and reapplying deletion after restoration: [enter]
- Handling of an ongoing access or erasure request: [enter]
- Execution: [date / scope / outcome / exceptions]
- Review and approval: [person / date]

## Sources

- [HGB section 257](https://www.gesetze-im-internet.de/hgb/__257.html)
- [AO section 147](https://www.gesetze-im-internet.de/ao_1977/__147.html)
- [GwG section 8](https://www.gesetze-im-internet.de/gwg_2017/__8.html)
- [GDPR Articles 5, 17 and 18](https://eur-lex.europa.eu/eli/reg/2016/679/oj)