Email archiving for SMEs: obligations and practice

The order arrives by email, the order confirmation goes out by email, and the price agreement sits somewhere in the thread. For many SMEs the mailbox is in fact the archive: nobody decided it that way, but nobody files the emails anywhere else. This raises questions that a boss rarely asks unprompted: do I have to retain emails? Which ones? For how long? And can the mailbox even do that job? This guide sorts out email archiving according to what the law actually says, and shows how to put it into practice in everyday work without losing sight of personal data.

Do I have to retain emails?

The answer is nuanced. Art. 958f, para. 1 of the Code of Obligations (CO, OR) requires the accounting records, the vouchers, the annual report and the audit report to be retained for ten years; the period begins on expiry of the financial year. This article does not recognise a separate category of “business correspondence”. That means Art. 958f CO does not give rise to an obligation to retain every email. The obligation attaches to the documents named.

This is not a free pass. First, an email can be an accounting voucher (see below). Second, the VAT Act (MWSTG) requires taxable persons to retain their accounting records, vouchers, business papers and other records properly until the tax claim becomes absolutely time-barred; Art. 958f CO remains reserved (Art. 70, para. 2 MWSTG). Which emails count as business papers or other records is not stated in the wording; here it helps to consult your fiduciary. Third, contracts, other laws or your own interest in evidence may suggest longer or broader retention. These questions do not belong in this guide.

When an email is an accounting voucher

The term is defined in Art. 957a, para. 3 CO: a voucher is any written record on paper or in electronic or comparable form that is necessary to be able to trace the business transaction or fact underlying a posting. Under this wording, function decides, not format. An email that triggers an order, confirms a delivery or records a price on which an invoice is later based can be an accounting voucher. An email arranging an appointment or a newsletter generally is not.

Whether an email is a voucher in a particular case is judged by the business transaction, not by the sender. A rule of thumb in practice, not a legal rule: if you could not explain the posting without this email, retain it. How to process incoming invoices by email properly is shown in the guide Processing incoming invoices digitally.

What the CO and GeBüV require of the archive

Accounting records and vouchers may be retained on paper, electronically or in a comparable way, provided that consistency with the underlying business transactions and facts is ensured and the records can be made legible again at any time (Art. 958f, para. 3 CO). The details are regulated by the Ordinance on Accounting Records (GeBüV). The points most important for emails:

Integrity: Under Art. 3 GeBüV, vouchers must be captured and retained in such a way that they cannot be changed without this being detectable.
Availability: Under Art. 6, para. 1 GeBüV, they must be capable of being inspected and reviewed by an authorised person within a reasonable time until the end of the retention period.
Inventory and access protection: Under Art. 8 GeBüV, the information must be systematically inventoried and protected from unauthorised access; accesses must be recorded.
Documentation: Under Art. 4, para. 1 GeBüV, depending on the nature and scale of the business, the organisation, responsibilities, processes, procedures and infrastructure must be documented in work instructions in such a way that the accounting records and vouchers can be understood.
Regular checks: Under Art. 10, para. 1 GeBüV, information carriers must be checked regularly for integrity and legibility.

The overall picture is explained in the guide Bookkeeping obligations for SMEs.

Why the mailbox is not an archive

An ordinary mailbox is designed for delivery and everyday use, not for provability. As a rule, emails can be moved, changed or deleted without this being recorded in a provable way. Anyone who uses a mailbox as an archive for vouchers should therefore clarify two things. First: Art. 9, para. 1, lit. b GeBüV sets additional conditions for alterable information carriers, all of which must be met, including technical procedures that ensure the integrity of the stored information, a storage time that can be proved to be unfalsified, and documented processes together with retained logs. Under Art. 9, para. 2, an information carrier is deemed alterable if stored information can be changed or deleted without this being provable on the data carrier. Whether your mailbox meets these conditions should not be assumed but clarified with the fiduciary or the auditors. Second: when a person leaves, their mailbox is often deactivated or deleted, and the emails disappear with it. This is a practical risk, not a legal consequence.

Emails contain personal data: the DSG

Almost every email contains names and email addresses, that is, details relating to an identified or identifiable natural person (Art. 5 lit. a of the Federal Act on Data Protection, DSG). Under Art. 5 lit. d DSG, “processing” expressly includes retaining and archiving. It follows that an email archive is subject to the principles of Art. 6 DSG: processing must be in good faith and proportionate (para. 2), the data may be processed only in a way that is compatible with the recognisable purpose (para. 3), and it is destroyed or anonymised as soon as it is no longer required for the purpose of processing (para. 4). Data security is added to this: the controller ensures, through suitable technical and organisational measures, data security appropriate to the risk (Art. 8, para. 1 DSG). And any person may request information from the controller about whether personal data concerning them is being processed (Art. 25, para. 1 DSG); a searchable archive makes such a reply easier.

In practice this means: archive what you can justify, not everything as a precaution. Separate what does not belong in the general archive, such as applications and other HR emails. And set out in a policy what may be in the business mailboxes. These are recommendations from practice.

Practical example: Berger Metall AG

Berger Metall AG is a fictitious company with 25 employees in Musterstadt; its financial year corresponds to the calendar year. Orders run through the shared mailboxes “sales” and “purchasing”. In autumn 2026 the managing director decides:

The mail archive is switched on.
The two shared mailboxes are connected; the HR manager’s mailbox is deliberately left out.
Docu | base fetches the emails of the years 2022 to 2026 from the connected IMAP mailboxes at the first sync; older individual emails are taken over as export files.
A policy states: orders, order confirmations and price agreements go through the shared mailboxes, not through private addresses.

An email dated 12.03.2027 shows how this works. A customer orders 120 brackets at CHF 155.00, that is CHF 18’600.00. The email triggers the order on which the invoice is based, so it is likely to be an accounting voucher. The period begins on expiry of the 2027 financial year on 31.12.2027 and runs ten years to 31.12.2037 (Art. 958f, para. 1 CO). An appointment email from the same day, in which a customer merely asks whether someone can be reached on Thursday, is not a voucher. Because the archive takes over entire mailboxes, it ends up in it all the same. The managing director therefore states in the policy that the shared mailboxes contain only business matters, and checks before the period expires whether emails without voucher character should be deleted earlier (Art. 6, para. 4 DSG).

Checklist

It is clarified which emails are accounting vouchers (function, not format)
The fiduciary or auditors have been involved on the retention of emails
The mailboxes to be archived are defined; HR emails and applications are excluded
Archiving is immutable and comes with an access log
The retention period is set (ten years from the end of the financial year for vouchers under Art. 958f CO)
Procedures and responsibilities are documented (Art. 4 GeBüV)
Integrity and legibility are checked regularly (Art. 10 GeBüV)
A policy on the use of business mailboxes is in place
Deletion after the period expires is regulated, with approval by a second person
Departing employees: the mailbox is backed up or archived before deletion

How KMU | base helps

In Docu | base the mail archive is a separate area that you switch on or off yourself. This is how the route looks.

1. Switch on the archive. Under More › Mail archive you decide whether Docu | base archives emails in an audit-proof way (“Turn on”/“Turn off”). The page requires an administration right for Docu. Docu | base does not file emails from the HR area of KMU | base, such as applications from HR | base, in the general mail archive. What is in a connected mailbox or an imported file, on the other hand, is archived in full. Do not connect mailboxes with applications or HR emails, therefore.

2. Import emails. You take over individual emails (.eml) or entire mailboxes (.mbox) from files, up to 25 MB per import. Docu | base takes over the emails unchanged, detects duplicates and archives immediately. Larger holdings you fetch via an IMAP mailbox.

3. Connect mailboxes. Under “Add mailbox” you enter label, IMAP server, port, username, password and the folders (default “INBOX, Sent”). The password is stored encrypted. Docu | base only reads the mailbox; it moves or deletes nothing there. The sync runs at the push of a button (“Sync now”) and additionally automatically every night.

4. Archive, find, prove. Every email becomes its own immutable archive entry with the original message including headers and attachments. A checksum (SHA-256) per file and a hash chain over entries and log help to prove that the email and the access log have not been changed since filing. Reading, downloading and denied accesses are logged in a chain. Using full-text search, you find emails by content and details. Emails fall into the retention class “Mail”; Docu | base suggests ten years from the end of the financial year. Whether an individual email is subject to a retention obligation is not assessed by the program; that remains your decision.

5. Delete with a second person. You delete expired documents only on request, which a second person approves or rejects. Early deletion is possible only with a legal ground (a deletion request under the DSG, withdrawal, purpose no longer applicable or misfiling) and never for classes with a statutory period. Docu | base does not treat the class “Mail” as a statutory period. Before you delete an email early, therefore, check yourself whether it is an accounting voucher under Art. 958f CO.

6. Document the procedure. For the documentation under Art. 4 GeBüV, you complete your part of the template, file versions with a validity date and download them as PDFs.

What Docu | base does not do: it takes over emails from files and from IMAP mailboxes; automatically archiving every sent email at the moment of sending is not part of the current scope. The program does not decide which emails are accounting vouchers, and it does not lock vouchers in the class “Mail” against early deletion by itself. And an archive is not proof of compliance: whether your entire procedure meets the requirements of the GeBüV is something you assess with your fiduciary or auditors.

If you would like to try it yourself, take a look at the Demo or open a test account. If you have questions, we will help you via the Contact page. You will find the current terms under Pricing.

Sources

Code of Obligations (OR, SR 220), Art. 957a, para. 3 and Art. 958f, paras. 1 and 3, as at 1 October 2026: fedlex.admin.ch (German original), accessed on 27.10.2026.
Ordinance on Accounting Records (GeBüV, SR 221.431), Art. 3, 4 para. 1, 6 para. 1, 8, 9 paras. 1 and 2, 10 para. 1, as at 1 January 2013: fedlex.admin.ch (German original), accessed on 27.10.2026.
VAT Act (MWSTG, SR 641.20), Art. 70, para. 2, as at 31 March 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
Federal Act on Data Protection (DSG, SR 235.1), Art. 5 lit. a and d, Art. 6, paras. 2 to 4, Art. 8, para. 1 and Art. 25, para. 1, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.

This guide does not replace legal or tax advice. Information as at 27.10.2026.