Document retention and GDPR compliance

Retention periods defined per category, applied automatically, with disposal proposals on schedule, human approval and a record of deletion requests.

Document compliance has two sides that seem to contradict each other. On one hand, the law requires you to keep certain categories for years — up to 10 years for registers and supporting documents, and 50 years for payroll records. On the other hand, GDPR forbids you from keeping personal data longer than necessary. Both are met only if you have an explicit retention policy, written by category, not by file. 4docs.net gives you the place where that policy lives: every category in the records schedule has a retention period, the period is applied automatically to every document within it, and at expiry you get a disposal proposal, which a human approves.

A retention period defined per records-schedule category, not per document — set once and applied everywhere.
Automatic calculation of the expiry date, starting from the document's date or from the closing of the file.
An alert before expiry and a list of disposal proposals, grouped by category and by year.
Disposal with human approval and a written record — nothing disappears automatically and silently.
A record of data-subject requests: access, rectification, erasure, with a tracked response deadline.
Blocking deletion for documents that still carry a legal retention obligation, even if deletion is requested.
A complete log: what was disposed of, when, by whom and under what rule.
A compliance report by category: what is kept, for how long and on what basis.

Legal retention periods, in short

The starting point is the Accounting Law (Law 82/1991), which requires, as a rule, that registers and supporting documents be kept for 10 years from the close of the financial year, and payroll records for 50 years, precisely because employment history is reconstructed from them. For some financial-accounting documents, the regulation sets a shorter period of 5 years (OMFP Order 2634/2015). The remaining categories — correspondence, internal notes, technical documentation, personnel files — get their periods through the company's records retention schedule, drawn up following the logic of Law 16/1996. Don't try to memorize these periods: write them once into the records schedule and let the platform apply them.

What GDPR requires on top of the archival-legislation periods

Regulation (EU) 2016/679 adds a principle that applies over all the others: storage limitation, set out in Art. 5(1)(e). Personal data is kept in a form that allows identifying people only for as long as necessary for the purpose it's processed for. The right to erasure, set out in Art. 17, lets the data subject request that their data be deleted — but this right isn't absolute: it yields, among other things, to legal retention obligations. In practice, if a former employee requests deletion, a payroll record cannot be deleted, because the law requires it to be kept. 4docs.net explicitly flags these situations, so your response is correct, not improvised.

What disposal on schedule looks like in the platform

Automatic, uncontrolled deletion is a bad idea: a misconfigured rule can wipe out an entire category. That's why the flow always has a human in it. With a configurable interval before expiry, the platform generates a list of proposals: which documents are reaching their deadline, from which category, on what basis. The person in charge reviews the list, excludes anything that must still be kept (for example, a file involved in litigation) and approves the rest. Disposal produces a written record of what was removed and under what rule, and the log keeps the trace. The document disappears; the proof that it was disposed of correctly remains.

Data-subject requests, kept in one place

An access or deletion request received by email and handled from memory is the most common point of failure for compliance. In the platform, the request is registered as such: who made it, what they're asking for, when it was received and by when it must be answered. Searching the archive shows you where that person's data appears, including in scanned documents, via OCR. The response is recorded together with the documents that supported it. In an inspection, you no longer have to reconstruct what happened eight months ago: the record is there, with deadlines and decisions.

Legal references

Regulation (EU) 2016/679 (GDPR), Art. 5(1)(e) — storage limitation: personal data is kept only for as long as necessary for the purpose
Regulation (EU) 2016/679 (GDPR), Art. 17 — the right to erasure ("the right to be forgotten"), which yields to legal retention obligations
Law no. 82/1991 — the Accounting Law: as a rule, 10 years for registers and supporting documents, 50 years for payroll records
OMFP Order no. 2634/2015 — for some financial-accounting documents the retention period is 5 years
Law no. 16/1996 — the National Archives Law: retention periods set through the company's records retention schedule

Frequently asked questions

How long do I have to keep my company's documents?

It depends on the category. As a rule, accounting law provides 10 years for registers and supporting documents and 50 years for payroll records; for some financial-accounting documents the period is 5 years. The other categories get their periods through the company's records retention schedule.

If someone asks me to delete their data, do I have to delete everything?

No. The right to erasure under Art. 17 GDPR isn't absolute: it yields wherever there is a legal retention obligation. A payroll record or a supporting document still within its legal period isn't deleted. The platform flags these situations, so the response to the data subject is properly justified.

Are documents deleted automatically at expiry?

Not automatically, and never silently. As the deadline approaches, you get a list of disposal proposals, you review it, exclude what must still be kept, and approve the rest. Disposal generates a written record and stays in the log.

What do I do with documents involved in litigation?

You place them on hold: they stay blocked from deletion regardless of their category's period, until the hold is lifted. This is exactly the mechanism that prevents evidence from being disposed of just because "that's what the rule said."

How do I demonstrate the retention policy to an auditor?

From the compliance report: which categories you have, what period each one carries, on what legal basis, and what was actually disposed of, with the written record. It's a list generated from real data, not a policy document kept separate from reality.

Is the period calculated from the document's date?

From the document's date, or from the closing of the file or the financial year, depending on the category — the rule is chosen once when configuring the records schedule, and then applied automatically.

Electronic archiving →The records schedule that every document inherits its period from.Secure sharing →Who sees what — the other half of GDPR compliance.How do you set a GDPR-compliant document retention policy? →The practical steps for a policy by category, not by file.How long are accounting documents kept? →The usual periods and their legal basis, explained briefly.Plans and pricing →Contact the team →

Put retention periods on autopilot

We write the retention policy by category together, apply it in the records schedule, and all that's left for you is approving disposals when they fall due.

See plans Contact a consultant