Data backup: this is how the law sees it

In Germany, the principles of data access and verifiability of digital documents regulate the necessity of backing up tax-relevant documents.

Strictly speaking, the legal aspects of data backup involve two questions: What am I allowed to do and what do I have to do? As long as the data remains in-house, all data that has been legally stored may of course be backed up. Problems can arise if the data is backed up or archived externally. As far as personal data of customers or employees is concerned, this is a transfer of data to third parties. However, this does not pose a serious problem if this point is included in the relevant declarations of consent.

What needs to be backed up?

In principle, all documents that could be required as evidence in civil proceedings at some point in the future must be backed up. This applies to all documents that are created due to a legal documentation obligation. This naturally includes invoices, delivery bills and other business documents that serve as proof of completed transactions. But numerous other documents also fall into this category. Doctors and lawyers must document the proper advice given to patients or clients, while companies must document compliance with official requirements. All these documents must not only be backed up, but also archived in an audit-proof manner. A document that can be changed at a later date has no probative value. There are numerous archiving systems available on the market that work with qualified time stamps, for example. This problem can therefore be solved technically.

Principles of data access and verifiability of digital documents

In Germany, all documents that have to do with taxes in the broadest sense are subject to the "Principles of data access and verifiability of digital documents". This is a binding administrative directive issued by the Federal Ministry of Finance that no company in Germany can ignore. The core of this instruction states that a tax auditor must be granted read access to all tax-relevant digital documents at any time upon request. This means much more than just having all the necessary documents on a backup tape somewhere in the basement. The documents from previous years must be backed up in such a way that the backup archives can be accessed at any time. There is probably no company that really fulfills the GDPdU 100 percent. This is because "tax-relevant digital documents" also include, for example, all internal emails relating to tax-relevant transactions. Every practitioner should know that no company is in a position to filter out all emails that someone in the company wrote to someone else years ago and that have any reference to a specific transaction. However, the strict requirements of the GDPdU should be adhered to for the documents that are usually relevant in the context of a tax audit.