Compliance
Compliance & Documentation
Technical measures and service evidence supporting your own retention and data-protection obligations.
The contradiction
The contradiction you have to manage
On one hand tax audits can exceptionally reach back up to 10 years, so matching coverage may be appropriate where that exception applies. On the other GDPR obliges you to delete records when no longer needed. The correct balance is a documented schedule selected with your legal or tax adviser.
Tax code
Law 5104/2024, Greek Tax Code
Sets a 5-year retention floor tied to the audit-limitation period: a 5-year base (+1 in specific cases), reaching 10 years only exceptionally, such as non-filing or new evidence. The service retention period is defined in writing for each data category in the Order Form, based on the customer's instructions and legal or professional assessment.
Data protection
GDPR Article 32 + Article 17
Article 32 requires appropriate technical and organisational measures for data security (encryption, resilience, restore tests). Article 17 requires deletion when the processing purpose ends.
Audit readiness
Documentation that may be requested in an audit
Depending on the scope of an audit, you may need to present:
- Data Processing Agreement (DPA) with every cloud provider
- Processing activity records
- Documentation of Article 32 technical measures
- Evidence of regular restore tests
- Retention & deletion policy with execution evidence
ArvaSafe supplies and refreshes the parts of this documentation that concern its service. Overall compliance and the general processing register remain your business's responsibility.
Deliverables
Documents we deliver
Data Processing Agreement
Legally valid DPA signed by both parties, with explicit confidentiality terms and sub-processor disclosure.
Article 32 evidence pack
Documentation of the technical and organisational measures ArvaSafe applies to the specific service.
Service entry for your processing register
We provide a completed entry for the ArvaSafe service so it can be incorporated into the customer's general record of processing activities.
EU sovereign
Processing regions and providers
Backup content is stored in the selected storage region recorded in the Order Form and DPA. Limited management, support, website, or communications data may be processed by the disclosed providers and sub-processors.
Legal references
Compliance by profession
Every profession carries its own record-keeping obligations. See the legislation that applies specifically to yours.
Accounting Firms
Law 5104/2024, myDATA, e-invoicing, and when retention beyond the five-year floor may be appropriate.
See detailsNotaries
Paper registers were abolished in May 2024, every notarial act now lives digitally, permanently.
See detailsInsurance Offices
Law 4583/2018, customer-needs evidence, policy records, and stronger protection for health and claims data.
See detailsLaw Offices
Legal professional privilege (Law 4194/2013) becomes a technical requirement once GDPR Article 32 applies.
See detailsClinics & Practices
Law 3418/2005: a 10-year legal minimum for private practices, 20 for clinics, the strictest retention floor of any sector we serve.
See detailsLegal references
The articles and laws behind this page
The obligations on this page come from primary law. Read the sources directly: