Email archiving: Obligations, deadlines & GDPR in Austria

Email archiving means storing business emails, including attachments, completely, systematically, and immutably so that they remain accessible and verifiable for years to come.

For Austrian companies, this is not a matter of expediency, but a legal obligation. As soon as an email documents a business transaction—a quote, an order confirmation, an invoice, or an acceptance—it is considered a business letter or document and is therefore subject to the same retention requirements as a paper document.

In practice, this leads to a misunderstanding with consequences: "It's all in the inbox" is not sufficient. This article explains which emails are affected, how long they must be stored, what "audit-proof" actually means, and how retention requirements and data protection can be reconciled.

Table of contents

• What email archiving means – and what it doesn't
• The legal obligation in Austria: Austrian Commercial Code (UGB) and Austrian Federal Fiscal Code (BAO)
• Which emails must be archived
• Retention periods and deletion concept
• Audit-proof archiving: the technical requirements
• Email archiving and GDPR
• Practical implementation: Microsoft 365, cloud, or your own server
• Conclusion – email archiving
• FAQ on email archiving

What email archiving means – and what it doesn't

An archive automatically captures business messages, stores them immutably, and makes them searchable at any time — regardless of whether the message still exists in the inbox.

This fundamentally distinguishes archiving from two things it is often confused with.

Archiving is not a backup

A backup creates copies of data to restore systems after a failure. It is snapshot in time, is overwritten after a certain period, and is not designed to retain individual messages for years.

In a tax audit, it is crucial that documents can be presented completely, in an organized manner, and with identical content. If only backups exist, searching for individual messages becomes time-consuming, recovery risky, and the traceability of deletions is usually impossible to prove. The article on cloud backup discusses alternative backup strategies.

A full mailbox is not an archive

The mailbox is a work tool. Folder structures differ from person to person, messages are moved, deleted, or stored locally, and access depends on the user account.

This results in three typical gaps:

• Personal dependency: If someone leaves the company, their correspondence is often no longer traceable.
• Lack of logging: It's impossible to prove whether a message was deleted or modified.
• Shared mailboxes: Addresses like office@ or accounting@ are used by multiple people without any clarity about who filed what.

An archive decouples storage from individual filing habits. That is precisely its purpose.

The legal obligation in Austria: UGB and BAO

In Austria, there is no specific "email law." The obligation arises from the general regulations governing the retention of business documents — and these focus on the content, not the medium.

Two areas of law are relevant:

• The Austrian Commercial Code (UGB) regulates the retention of books, receipts, and business correspondence. The relevant provision can be found in Section § 212 UGB.
• The Austrian Federal Fiscal Code (BAO) regulates the tax-related retention obligation and the obligation to submit documents in tax proceedings. The Austrian Business Service Portal summarizes the retention obligation and its duration.
  

Does this also apply to small businesses?

Yes. The obligation arises from the content and nature of business transactions, not from company size. Even a sole proprietorship must retain invoices, order confirmations, and business correspondence.

However, the scope varies depending on the business model. A project-oriented service provider primarily documents approvals, acceptances, and change requests via email and therefore has a correspondingly high need for documentation. A business with standardized cash sales generates significantly less correspondence requiring documentation.

When does an email become a business letter?

An email becomes relevant as soon as it documents the conclusion, modification, or execution of a business transaction. This applies not only to formally written correspondence.

Even a brief reply like "That's fine, please implement" can be crucial evidence in project-based business. What matters is its function within the business process, not the subject line or the length of the message.

Important in practice: Content, headers, and attachments belong together. Storing an invoice as a PDF in the accounting system might suffice—but proof of sending or receiving via email can be just as decisive in a dispute.

Which emails need to be archived?

Instead of individual lists, a review based on four criteria is helpful:

1. Does the email document a business transaction or a decision?
2. Does it have tax relevance or serve as supporting documentation?
3. Would the content be admissible as evidence in a dispute?
4. Is an attachment an integral part of the message?

If any of these questions are answered with "yes," the message should be archived.

Caution regarding the right-hand column: A confirmation of appointment becomes subject to retention requirements as soon as it documents a binding commitment or acceptance of services. In case of doubt, the evidentiary function takes precedence over the outward appearance.

The reverse is equally important: Not permanently storing everything is not an oversight, but a data protection requirement. A blanket full archiving of all mailboxes creates unnecessary repositories of personal data.

Those who want to clearly define this framework for their company usually need both: legal classification and technical implementation. FIGULI CONSULTING supports Austrian SMEs with document management and archiving projects: from defining the scope of archiving and integration with Microsoft 365 to search, export, permissions, and deletion rules. Depending on the environment, an audit-proof archiving solution such as Inoxision can be used.

Clarify your archiving obligations with FIGULI

Retention periods and deletion concept

The general retention period in Austria is seven years. It begins at the end of the calendar year to which the document belongs – an invoice from March therefore does not start from March, but from the following year's end.

When the deadline is extended

Seven years is the standard retention period, not the maximum. Longer retention periods are required, for example, if documents are relevant to pending legal proceedings.

Furthermore, longer retention periods may arise from:

• contractual documentation obligations to clients
• long warranty or liability periods, such as in the construction industry
• projects with a duration of several years
• industry-specific regulatory requirements

Do not treat such cases as isolated exceptions, but rather as a defined additional category with documented justification, such as "Project X – extended retention until 2035." Otherwise, a patchwork of regulations will emerge that will be difficult to understand after a few years.

Why a deletion concept is essential

An archive without deletion policies is incomplete. Data should be systematically deleted after the retention period expires, unless there is another reason for its continued storage.

This is not only for data protection purposes. In practice, an archive that has contained everything for fifteen years is unusable for research and poses a risk in the event of a dispute: anything that exists can be requested.

Audit-proof archiving: the technical requirements

"Audit-proof" is not a seal of approval, but a collection of verifiable characteristics. An archive should meet these six requirements:

• Completeness: Messages are automatically captured upon arrival and departure, not through manual moving.
• Immutability: Once archived, content cannot be subsequently altered or removed without detection.
• Traceability: Every access, search, and export is logged.
• Findability: Full-text search across content, headers, and attachments.
• Presentation capability: Export in a common, readable format including context.
• Readability over the entire retention period: The content must still be readable and analyzable in seven years.

The first point is the most important and most frequently underestimated. As soon as archiving depends on someone consciously filing a message, it is incomplete. Capture must occur automatically on the mail server before a message even arrives in the mailbox.

Equally important is a role-based access control system: Who is allowed to search the archive? Who is allowed to export? An archive contains all business correspondence – unrestricted access for everyone would be neither compliant with data protection regulations nor operationally sensible.

Email archiving and GDPR

At first glance, data retention obligations and data protection seem contradictory: one requires storage, the other deletion. This can be resolved through the principle of purpose limitation.

Data is retained to fulfill a legal obligation. As long as this obligation exists, it takes precedence over a request for deletion. If a person requests the deletion of their data, this does not apply to invoices and business correspondence, which must be retained by law.

This results in specific requirements:

• The archive must be included in the processing register, specifying the purpose, legal basis, and retention period.
• Data subjects must be informed about the data retention in the privacy policy.
• Access must be restricted to a defined group of people and logged.
• Data must be deleted according to schedule after the retention period expires.
• A data processing agreement is required for external providers.

A special point is the private use of company email accounts. If this is permitted or tolerated, archiving becomes problematic from a data protection perspective because private communication would also be recorded. The best approach is a clear written policy that excludes private use or refers to a separate email account.

The Austrian Data Protection Authority provides an overview of the obligations of data controllers, and we have developed a toolkit to help meet GDPR requirements.

Practical introduction: Microsoft 365, cloud or own server

Is Microsoft 365 sufficient on its own?

Microsoft 365 offers features like retention policies and an archive mailbox. These are helpful, but only partially replace dedicated archiving.

Especially in Microsoft 365 environments, email archiving should be clearly separated from Microsoft 365 backup. Archiving serves long-term traceability and orderly storage. Backup serves for recovery after loss, failure, or accidental deletion.

The difference lies in traceability and independence: A separate archive keeps storage separate from the production mail system, logs access separately, and remains available even when mailboxes are moved, licenses are changed, or accounts are deleted. The last point is relevant in practice: If a departing employee's license is removed, the associated mailbox disappears after a transition period.

Cloud or own server

For most SMEs, a cloud solution is the more pragmatic approach, provided data location and contract terms are clearly defined. An in-house archive remains a viable option if there are specific requirements regarding data location or if a document management system is already in operation.

In practice, a specialized archiving solution like Inoxision can be beneficial for SMEs if they need to automatically capture emails, store them in an audit-proof manner, make them searchable, and export them as required. Crucially, the solution must be compatible with the existing IT environment, Microsoft 365, and internal permission and deletion policies.

Steps for implementation

1. Inventory: Which mailboxes exist, and which business transactions are conducted via email?
2. Define scope: Which mailboxes will be captured, and which categories apply?
3. Regulate private use: a written agreement before archiving
4. Define retention periods: seven years as a rule; special cases require separate justification
5. Define permissions: Who is allowed to search, and who is allowed to export?
6. Technically integrate: Capture on the mail server, transfer existing data
7. Document: Processing register, privacy policy, internal guidelines
8. Rehearse a real-world scenario: search for and export a specific message before an audit is conducted

The last step is regularly skipped, yet it is the most important. An archive from which no one has ever retrieved anything is an untested archive.

Conclusion

Mail Archivierung ist in Österreich keine Kür. Sobald E-Mails Geschäftsvorgänge dokumentieren, unterliegen sie denselben Aufbewahrungspflichten wie Papierunterlagen – in der Regel sieben Jahre, gerechnet ab dem Ende des jeweiligen Kalenderjahres.

Entscheidend sind drei Punkte: Die Erfassung muss automatisch erfolgen, nicht abhängig vom Ablageverhalten Einzelner. Das Archiv muss unveränderbar und durchsuchbar sein. Und es braucht ein Löschkonzept, das Aufbewahrungspflicht und Datenschutz zusammenführt.

Der häufigste Fehler in KMU ist nicht die bewusste Entscheidung gegen ein Archiv, sondern die Annahme, das Postfach genüge. Diese Lücke fällt meist erst dann auf, wenn eine Prüfung ansteht oder eine Nachricht aus einem längst gelöschten Postfach gebraucht wird.

FIGULI CONSULTING unterstützt österreichische Unternehmen dabei, Mail Archivierung als Teil einer sauberen IT- und Dokumentenmanagement-Struktur umzusetzen. Dazu gehören die technische Anbindung an Microsoft 365, passende Berechtigungen, nachvollziehbare Abläufe, sichere Speicherung, eine laufende Betreuung der Systeme und der DSGVO Werkzeugkasten.

Mail Archivierung mit FIGULI umsetzen

Email archiving is mandatory in Austria. As soon as emails document business transactions, they are subject to the same retention requirements as paper documents – generally seven years, calculated from the end of the respective calendar year.

Three points are crucial: Capture must be automated, not dependent on individual filing habits. The archive must be immutable and searchable. And a deletion concept is needed that reconciles retention requirements with data protection.

The most common mistake in SMEs is not consciously deciding against an archive, but rather assuming that the mailbox is sufficient. This shortcoming usually only becomes apparent when an audit is due or a message from a long-deleted mailbox is needed.

FIGULI CONSULTING supports Austrian companies in implementing email archiving as part of a clean IT and document management structure. This includes technical integration with Microsoft 365, appropriate permissions, traceable processes, secure storage, ongoing system support, and the GDPR toolkit.

Implement email archiving with FIGULI

FAQ about email archiving

Is email archiving mandatory in Austria?

Yes. Business emails that constitute business letters, receipts, or tax-relevant documents must be retained. The legal basis for this can be found in the Austrian Commercial Code and the Austrian Federal Fiscal Code. There is no specific email law; the general regulations focus on the content.

How long must business emails be retained?

The general retention period is seven years, starting from the end of the calendar year to which the document belongs. This period is longer, for example, if the documents are relevant to pending legal proceedings or if there are contractual documentation obligations.

Is a backup sufficient as an archive?

No. A backup is used for restoration after a failure, is overwritten, and does not allow for targeted searches for individual messages. An archive preserves messages immutably for the entire retention period and provides a traceable log of access.

What does "audit-proof" mean?

Audit-proof means that messages are fully and automatically captured, stored immutably, logged, searchable, and exportable in a readable format – throughout the entire retention period.

Is Microsoft 365 sufficient for archiving?

Microsoft 365 offers retention policies and an archive mailbox that can serve as a basis. However, a dedicated archive separates the storage from the production system and remains available even if mailboxes are migrated or accounts and licenses are deleted.

How do archiving and GDPR fit together?

Retention is carried out to fulfill a legal obligation and therefore takes precedence over a deletion request. This requires an entry in the processing register, information in the privacy policy, restricted access, and scheduled deletion after the retention period expires.

Can private emails be archived as well?

This is a sensitive issue. If private use of the company mailbox is permitted or tolerated, complete archiving would also capture private communication. A written agreement prohibiting private use or specifying a separate mailbox is recommended.

Does email archiving need to be audit-proof?

Business emails should be archived in such a way that they remain complete, unalterable, retrievable, logged, and readable for the entire retention period. In practice, this is often referred to as audit-proof email archiving. What's important is not a single certification mark, but rather that the requirements are met and documented in a verifiable manner.