Luxembourg Business
Email Retention
With just a few exceptions, almost all document types need to be kept for 10 years.
With just a few exceptions, almost all document types need to be kept for 10 years.
The General Data Protection Regulation (GDPR) applies, so you must not keep personal identifiable information, such as data about former employees, longer than is absolutely necessary.
| Retention Period | Document Type/Related Emails |
|---|---|
| 10 years | Accounting and finance documents (general ledgers, financial statements, audit reports, P&Ls, etc.) with supporting documents and related correspondence Admin documents relating to company business activity (title of intellectual property rights, licenses, permits and authorizations, among others) Bank documents (account statements, etc.) Claims management documents Commercial agreements and related documents/agreements (e.g. NDAs) with clients, suppliers and subcontractors Commercial correspondence with clients, suppliers, sub-contractors (mail and emails received and copies of mail and emails sent) Commercial lease Commercial litigation files Employment contracts, data related to identification, administration and organisation Insurance contracts Invoicing information, including payment collection data and external dunning (judicial procedure) Notification to the National Commission for Data Protection of a data breach or violation Payments to suppliers Pay slips Payroll documents relating to taxes, social security, extra hours, bonus, expenses, advantage in kind Partner-related documents (suppliers, subcontractors, data processors) Tax returns and documentation for inter-group pricing policies VAT registry for the delivery or acquisition of goods or services within the EU, import/export documents related to the VAT |
| 5 years | Documents relating to employee sick leave and maternity leave (keep 5 years from end of year in which contributions were paid) Corporate documents such as shareholder register, minutes of board, committee and shareholder meetings |
| 3 years | Information request to the National Commission for Data Protection |
Sources: Armaedfoundation.org dsm.legal