SaaS backup requirements in Germany: GoBD, GDPR and retention rules

An order confirmation sits in your CRM. A customer approval is attached to a project. An invoice arrives as a structured electronic file. Your team may treat these as everyday SaaS data, but some also belong in your company's legally required business records.

For German businesses, that creates two questions: can you recover the information if it disappears, and can you preserve the required records for as long as the law demands?

GDPR addresses security and recovery for personal data. Germany adds commercial and tax recordkeeping rules, including the GoBD, that affect how certain records must be protected and retained. This guide explains how those requirements fit a SaaS backup plan, with additional checks for regulated sectors.

Start with the records in your apps

The main German recordkeeping rules sit in the Handelsgesetzbuch (HGB, Commercial Code), Abgabenordnung (AO, Fiscal Code) and Umsatzsteuergesetz (UStG, VAT Act).

Their relevance depends on your business and the records involved. A SaaS application can hold accounting evidence or business correspondence even if nobody considers it an accounting system. An accepted quotation or an exchange confirming a transaction may need to be preserved because of its content. That does not make every task, contact or informal comment a statutory business record. HGB §257, AO §147

A useful first step is to ask your finance team which records it would need to explain a transaction during an audit. Then locate those records across your apps, attachments and exports.

How long must German businesses retain records?

The common statutory periods are:

• 10 years: Accounting books, inventories, opening balance sheets and annual financial statements.
• 8 years: Accounting vouchers and invoices.
• 6 years: Received and sent commercial or business correspondence.

These are category-specific rules, subject to the applicable law. For example, specified banks, insurers and investment firms must retain accounting vouchers for ten years. Tax-related circumstances can also extend retention. HGB §257, AO §147, UStG §14b

The clock generally starts at the end of the calendar year containing the relevant event, such as issuing the invoice or receiving the correspondence. It does not restart whenever you make a backup.

For example, under the ordinary eight-year rule, an invoice issued in 2026 would normally be retained through 31 December 2034. Check for extensions before deleting it. UStG §14b

Set retention by record category. Keeping every daily snapshot of an entire CRM for ten years can retain unrelated personal data unnecessarily, while still leaving gaps if the snapshots omit a required attachment or original document.

What GoBD means for SaaS backups

GoBD is the German tax administration's guidance on proper electronic recordkeeping and access to data. It explains how statutory accounting requirements apply to digital systems, including relevant cloud and supporting systems.

Its data-security provisions require protection against loss and unauthorised changes. The description of backup procedures belongs in the business's process documentation, known as Verfahrensdokumentation. BMF GoBD, paragraphs 103–106

For a SaaS workflow, make that documentation concrete. Identify the records covered, how copies are created, who checks failures and how recovery works. Record any gaps, such as an attachment type your backup does not capture. A safe restore exercise helps establish whether the documented procedure works in practice.

GoBD also addresses traceability, integrity and continued access to retained records. A software subscription or supplier certificate does not establish that your whole recordkeeping process meets those requirements. BMF GoBD

Backup and archiving answer different questions

A recovery backup helps you return to a usable version after deletion, corruption or another incident. An archive preserves the records you must retain, with the integrity, context and accessibility required for their retention period.

Consider an invoice attached to a CRM deal. A backup may let you recover last week's attachment. Your recordkeeping process must also preserve the required invoice content and keep it accessible years later, potentially after you have changed CRM providers.

One system may support both purposes, but assess each separately. Check whether original content and subsequent changes remain traceable, whether records can be found and read, and whether required electronic data remains available for tax-authority evaluation. HGB §239, AO §147

Preserve the structured e-invoice

Germany's e-invoicing rules make the distinction particularly practical. Since 1 January 2025, domestic businesses have needed to be able to receive e-invoices for relevant domestic B2B transactions. Issuing requirements have transitional arrangements.

At least the structured invoice component must be retained intact in its original form. A PDF rendering or screenshot alone can lose the machine-readable information. BMF also clarifies that, for VAT purposes, storing an e-invoice outside a GoBD-conformant system does not by itself generally breach invoice-retention requirements; separate accounting obligations still apply. BMF e-invoice FAQ

Check the actual file your workflow preserves, especially when an integration converts or previews attachments.

How GDPR affects your backup policy

GDPR, called DSGVO in German, requires security appropriate to the risks of processing personal data. Article 32 includes timely restoration after incidents and regular evaluation of safeguards where appropriate. It does not prescribe one backup frequency or retention period for every business. GDPR Article 32

Retention also needs a purpose. A legal duty to preserve an invoice can justify retaining the necessary personal data, but does not automatically justify keeping the customer's entire CRM history for the same period. Storage limitation and erasure rules still matter. GDPR Articles 5 and 17

Agree how your team will handle erasure requests in backup copies and after restoration. Germany's BDSG adds rules for areas such as employee and certain sensitive-data processing, so include HR and sensitive records in that assessment. BDSG §22, §26

Our SaaS backup and compliance guide covers the broader European requirements, including processor agreements and international transfers.

Must German business backups stay in Germany?

There is no general rule requiring every German company's SaaS backup to be stored in Germany. The answer depends on the records, processing arrangements and applicable sector rules.

Tax law adds a specific check. AO §146 allows electronic recordkeeping elsewhere in the EU subject to required tax access. Keeping those records in third countries requires tax-authority permission under the applicable conditions. Electronic invoices stored elsewhere in the EU also have notification and access requirements under UStG §14b. AO §146, UStG §14b

Assess where statutory records are actually maintained; do not assume every auxiliary disaster-recovery copy amounts to relocating the accounting system. Separately, review GDPR transfer safeguards, subprocessors and access from other countries. Choosing an EU storage region answers only part of that assessment. GDPR Articles 28 and 44–49

Additional checks for regulated businesses

NIS2 and Germany's BSI Act

Germany's NIS2 implementation entered into force on 6 December 2025. For covered entities, BSIG §30 expressly includes backup management and disaster recovery in the required security measures. Scope depends on the entity type, sector, size and statutory exceptions. Using SaaS alone does not bring a business into scope. BSIG §§28–30

If your business is covered, include the SaaS services your operations depend on in continuity planning. Define acceptable data loss and recovery time, then test whether the complete workflow can meet those targets.

Healthcare, professional secrecy and finance

Covered healthcare providers, statutory health and care insurers, and their processors face additional conditions for cloud processing of health and social data under SGB V §393. These include permitted processing locations, a German-establishment condition, C5 assurance or a qualifying alternative, and customer-side controls. A generic GDPR statement is insufficient to assess these requirements. SGB V §393

Doctors, lawyers and other specified professions must also account for professional secrecy when involving service providers. Lawyers have additional outsourcing requirements, including safeguards for services abroad. StGB §203, BRAO §43e

Financial entities should assess DORA's backup and recovery requirements and their applicable supervisory rules. DORA is EU-wide, with scope-dependent exemptions and simplified arrangements. DORA Articles 2, 12 and 16

A practical checklist for your SaaS data

Use these steps to turn the requirements into a working process:

1. Identify which records in each app support transactions, accounting or other legal duties. Include attachments and structured originals.
2. Assign retention periods by record category, with a documented reason and any applicable extensions.
3. Assess recovery and archival requirements separately. Check what your tools capture, preserve, export and restore.
4. Review storage locations, provider access and contracts against tax, privacy and sector requirements.
5. Document responsibility for backup failures, restoration and deletion. Test a representative recovery and record what remains missing.

Where ProBackup fits

ProBackup provides an independent backup layer for supported SaaS applications, with automated daily backup cycles and recovery options that vary by integration. Check your app's supported data types, available retention and restore capabilities against the workflow you need to protect. Explore ProBackup's backup coverage

Those copies can support your recovery plan. Statutory archiving, record classification and sector-specific obligations still need their own assessment.

Start with one business-critical app: identify the records that matter, check their backup coverage and run a representative restore. Use the result to document what your team can recover and what additional preservation process it needs.

‍