Accounting Firms
Accounting-record retention is chained to the tax-audit limitation period, and that changes what "enough backup" actually means.
Legislation
The retention floor is five (5) years from the end of the tax year, but it's chained to the audit-limitation period (Article 37) or to a case becoming final. Article 37 sets a 5-year base limitation (+1 year in specific cases), reaching 10 years only exceptionally (non-filing, new evidence). A longer period may be appropriate where an Article 37 exception applies or professional advice justifies it.
Mandatory real-time transmission of invoice/expense data. myDATA keeps what you reported to the tax authority, not your actual files, your accounting software's database, or client folders.
Phase A (turnover >€1M): from 2 March 2026. Phase B (everyone): from 1 October 2026.
Licensed accountants carry a confidentiality duty over the client data they handle (Decision 57088/2013, Article 8).
Explicitly requires "the ability to restore the availability and access to personal data in a timely manner", i.e. a documented backup/restore capability.
Recovery design
An accounting firm does not recover from one document; it recovers when ledgers, source records, and submissions can be tied together again.
The accounting application's database or supported export, source invoices, and mappings needed to reconcile with myDATA should share a coherent recovery point.
Payroll files, contracts, and employee records need separate permissions and controlled restores because they should not be visible to every user in the firm.
Returns, submission receipts, correspondence, and correction versions should be recoverable together so the firm can evidence what was filed, when, and from which records.
Enforcement
Two cases that show where oversight in your sector is focused:
Fined for inadequate security and backup measures (GDPR Articles 5(1)(f) and 32), the sector's reference case.
Reprimand of an accountant for processing an heir's data without a lawful basis.
Practical answers
No. myDATA contains information transmitted to AADE, not necessarily the accounting application's database, source invoices, mappings, payroll files, or client correspondence. The recovery process must cover the agreed local file set and, where required, the application or a supported export from it.
The test should follow a real work scenario: restore selected source records, exports, or an in-scope database; verify that they open with the required software; and confirm that restricted folders such as payroll remain available only to authorised users.
There is no single ten-year rule for every record and case. Retention should be set by data category, taking account of the ordinary tax period, any applicable exceptions or open matters, and advice from the firm's tax or legal adviser. ArvaSafe operates the schedule agreed in writing.
The Fix
Related professions
Each profession has a different working file, access model, and recovery order.
Contact
Two simple ways to get started. Pick whichever feels right, both reach me directly.
Option 1, Fastest
Pick a time that suits you. I'll review your backup setup, answer service questions, and explain what ArvaSafe can address, no obligation.
Booking is provided by Google Calendar. Opening it sends technical information to Google.
Option 2, Send details
Prefer email? Tell me a bit about your business and what you need. I reply within 1 business day with a written quote.
