Replace GRC spreadsheets
A GRC migration starts with fields, responsibilities and data quality. This sequence moves from the existing workbook through a trial run to business acceptance.
First version: Updated:
Read articleArticle
GDPR retention periods in banks: classifying records correctly
Bank data has no single retention period. A deletion policy connects record type, legal basis, start date and justified exceptions with the data actually held.
In daily work
Classify records rather than entire systems
A customer file may contain business correspondence, accounting vouchers, identification records and other personal data. Sharing one storage location does not give them the same retention period. Current HGB section 257(4) requires ten years for accounting vouchers of the listed KWG institutions, insurers and investment firms. The general eight-year rule for vouchers therefore cannot simply be applied to banks.
Overview
Use a retention matrix as a starting point
This overview covers central German rules. Also assess the actual document, additional obligations and application or transitional provisions.
| Record | Standard period | Starting point / qualification |
|---|---|---|
| Books, inventories, financial statements and related organisational documents | 10 years under HGB section 257 | End of the calendar year of the event specified by law |
| Accounting vouchers at institutions under HGB section 257(4), second sentence | 10 years | End of the calendar year in which the voucher arose |
| Received and sent business correspondence | 6 years under HGB section 257 | End of the calendar year of receipt or dispatch |
| AML records under GwG section 8(1)–(3) | 5 years unless a longer statutory period applies | Business relationship: year-end of termination; other cases: year-end of determination |
| Other personal data without a statutory retention requirement | No general period | Assess necessity for the purpose and legal basis |
Overview
Resolve overlapping rules and holds explicitly
AO section 147 has its own periods and can postpone expiry while records remain relevant to taxes whose assessment period has not expired. GwG section 8 generally requires destruction of its records after no more than ten years. Simply choosing the longest imaginable period does not resolve such conflicts. Assess the particular records, purposes and legally justified holds. Give each hold a reason, owner and review date so it cannot silently become permanent.
Overview
Distinguish retention from further use
The GDPR requires storage limitation. Article 17(3) provides exceptions to erasure, including legal obligations and establishing, exercising or defending legal claims. Continued retention does not authorise unlimited reuse. Limit archive access and permitted purposes accordingly. Formal restriction under Article 18 applies only when its own conditions are satisfied, not automatically whenever a retention obligation exists.
Overview
Calculate the date using a documented example
Working example: a letter classified as business correspondence is received on 15 June 2026. Its six-year period begins at the end of 31 December 2026 and expires at the end of 31 December 2032. Deletion from 1 January 2033 may be appropriate if no other applicable obligation or justified hold remains. An accounting voucher from the same bank and year may have a different deletion date because of the ten-year rule.
Overview
Implement deletion across applications and copies
A practical register includes the data class, authoritative system, copies, purpose, provision, trigger, period and deletion procedure. Include exports, document stores and recovery procedures. For backups, document when data expires and how overdue deletions are reapplied after restoration. A verification record shows scope, exceptions and outcome without unnecessarily storing the deleted content again.
FAQ
Frequently asked questions
Can banks delete accounting vouchers after eight years?
Do not assume so. HGB section 257(4), second sentence, specifies ten years for the institutions it covers. Assess record type, application rules and other obligations.
Does the AML retention period always start when data is collected?
No. For the business relationship addressed in GwG section 8(4), it starts at the end of the calendar year when the relationship ends. Other cases relate to the year in which the information was determined.
Can an erasure request simply be postponed until every retention period expires?
The request must be processed and assessed for the data concerned. Retention duties for particular records do not justify a blanket refusal to erase all other data.
Sources & further reading
Related options
You may also be interested in these.
IT and AI consulting
T-NEX advises banks and insurers on software projects and GRC processes, with functional specifications, technical planning and an agreed implementation scope.
Explore serviceWhich task would you like to solve next?
Bring a concrete task. Together, we will define what the application needs to do.
Discuss your project