On the file server, filing usually grows by itself: every department creates folders to its own taste, and after a few years only the person who built the folder can find their documents. A good filing structure with well-considered folders saves search time every day, clarifies who may see what, and makes later retention and deletion questions easier. This guide shows the principles on which SMEs build their folders, how access rights fit in and how to tidy an existing filing system step by step.
What a good filing structure must achieve
A filing system is good when three things work: documents can be found in a few clicks, the right people have access, and it is clear for every document how long it is retained. The folder structure is the framework for this. It answers the question “Where does this belong?” so unambiguously that two people independently choose the same place.
The following applies: the structure does not replace search, it complements it. Even in the best filing system, nobody wants to click three times when an invoice number is enough. Full-text search remains important; the folders serve the overview and the rights.
Three layout models compared
There is no single right model, but there are three common ones. The following table describes them as practice, not as a rule:
| Model | Layout | Strength | Weakness |
|---|---|---|---|
| By document type | Company, year, type (invoices, contracts, quotes) | Clear rules, good for bookkeeping and retention | Everything about one customer is scattered |
| By customer or project | One dossier per customer or project with subfolders | Everything important about one case in one place | Questions across types (all contracts) need the search |
| By department | One branch per department | Matches the organisation chart | Responsibilities change, the filing stays |
In practice a mix works well: commercial material is filed by company, year and type, because retention and year-end closing are oriented to it. For customer-related or project-related documents, a dossier is added. Organising by department is advisable only for areas that really work separately, such as HR.
Rules for naming and depth
Simple rules have proved their worth in practice, though they have no statutory basis:
- At most three to four levels. Anyone who needs ten clicks will eventually create “Miscellaneous”.
- One filing location per document. Copies in several folders diverge. Anyone who needs a second reference creates a link.
- Consistent names. Date first in the format YYYY-MM-DD, then partner, then content, so that files sort themselves.
- Retention depends on the document type, not on the folder. A contract remains a contract, even if it sits in the project folder.
- Confidential material gets its own branch. Payroll, contracts of the management or personnel documents do not belong in a folder that everyone sees.
- Personal working documents belong in personal storage, so that the shared filing stays clean and it is clear where drafts go when someone leaves.
Folders and access rights
A folder structure is also a rights structure. Anyone who assigns rights per folder does not have to regulate each document individually. A procedure in four steps has proved its worth: first you decide which roles may read or change at all. Then you assign rights at the top level of a branch and let subfolders inherit. Exceptions, for example for payroll documents, deliberately interrupt the inheritance. And finally you regularly check who has access where, ideally on joining, leaving or a change of role.
Distinguish the permission levels here: anyone who is only meant to read a document does not need the right to change it. And anyone who only has to pass through a folder to reach a subfolder does not need to see the entire contents of the parent folder.
What the law says
The law prescribes no particular folder structure. For accounting records and vouchers, however, the Ordinance on Accounting Records (GeBüV) requires some properties that directly affect filing:
- Under Art. 5 GeBüV, accounting records and vouchers must be retained carefully, in an orderly manner and protected from harmful influences.
- Under Art. 7, para. 1 GeBüV, archived information must be kept separate from current information or marked in such a way that the two can be distinguished; responsibility for the archived information must be clearly regulated and documented.
- Under Art. 8 GeBüV, the information must be systematically inventoried and protected from unauthorised access. Accesses and entries must be recorded, and these records are subject to the same retention obligation as the data carriers.
This concerns the retention of accounting documents; you will find more in the guide Bookkeeping obligations for SMEs. For personal data in the filing system, the Federal Act on Data Protection (DSG) also applies: personal data must be destroyed or anonymised as soon as it is no longer required for the purpose of processing (Art. 6, para. 4 DSG), and the controller ensures, through suitable technical and organisational measures, data security appropriate to the risk (Art. 8, para. 1 DSG). A clean folder and rights structure is a building block for this, but no proof in itself.
Practical example: Kunz Bau AG
Kunz Bau AG is a fictitious construction company with 18 employees in Musterstadt. So far everything has been on a file server, with folders such as “New”, “Old” and “Customers 2019 to 2024”. The managing director wants to tidy up and decides on the following layout:
| Area | Layout | Access |
|---|---|---|
| Commercial | Kunz Bau AG, then year, then invoices, contracts, quotes, correspondence | Office: change; management: manage |
| Projects | One dossier per project with eight subfolders: contracts, quotes, plans, permits, minutes, photos, acceptances, invoices | Project managers: manage; office: read |
| HR | Separate filing in the HR software, not in the general filing | Only management and HR managers |
| Personal | One personal storage per employee | Only the person |
For three current projects, this gives three dossiers with eight subfolders each, so 24 subfolders. The project managers do not have to create them by hand and need to follow only one rule: whatever belongs to a project goes into the dossier. The invoices of a project nevertheless remain invoices; their retention follows the document type, not the project folder. When a project manager changes in spring 2027, the managing director uses “Who has access?” to check who still has access to the dossier. He takes over the existing filing from the file server with a dry run before anything changes.
Checklist
- Layout model chosen: company, year and type for the commercial side, dossiers for customers and projects
- At most three to four levels, consistent naming
- Every document has exactly one filing location; further references are links
- Retention periods depend on the document type
- Rights are assigned per folder and inherited; exceptions are set deliberately
- Confidential material (payroll, HR) is kept separate
- Personal working documents have personal storage; leaving is regulated
- Responsibility for archived documents is laid down in writing
- Access rights are checked on joining, leaving and a change of role
- A dry run is done first for a changeover
How KMU | base helps
In Docu | base you build the folders from rules and add your own folders where needed. This is how the route looks.
1. A filing rule per document type. Under More › Document types you determine for each type which folder a document falls into and which retention period applies. The filing rule works with placeholders, such as {firma}/{jahr}/Rechnungen. Ready-made document types come with sensible rules.
2. Folders from the details. On the Documents page you find the documents automatically organised by company, year and document type, without folders having to be maintained by hand. In addition there are real folders: you create folders and subfolders, upload files straight into them, rename, and move documents and folders. For archived documents only the filing location changes, and every change is logged. Anyone who wants to generate real folders from the existing filing rules uses Set up folders: a dry run shows which folders are created and which documents are filed; only then do you apply it. Setting up is reserved for people with the administration right for Docu.
3. Dossiers and filing plans. For each customer, supplier, project, employee and property, Docu | base creates a dossier with subfolders by itself as soon as the contact or project is created or opened in one of the apps. Under Files › Filing plans you decide which folders a new dossier receives, or adopt a ready-made plan for fiduciary, construction, hospitality or medical practice. Changes apply to new dossiers; existing ones stay as they are. If HR | base is booked, the “Employees” dossier is switched off by default, because the personnel file is kept there.
4. Rights per folder. Under Manage folder you determine for each folder which person, role or department may read, change or manage. Subfolders inherit, the inheritance can be interrupted, and “Who has access?” shows the reason for an access. Anyone who administers Docu for a company always has access to its folders. Confidential document types you additionally release only to certain roles.
5. My storage and migration. Every person has personal storage that only they see; they share individual folders or documents selectively. Before leaving, the person is informed and can delete or download private material; on the leaving date the storage passes, with a log entry, to the line manager, otherwise to the Docu administration. You take over your existing filing, for example from the file server, under More › Migration together with the folder structure and rights: first a dry run, then apply, without duplicates and repeatable as often as you like.
What Docu | base does not replace: you have to define the structure yourself; an industry plan is a suggestion that you adapt. A document has one filing location; you create further references through links. And the rights regulate who sees a document; they replace neither the data protection concept nor the procedural documentation of your business.
If you would like to try it yourself, take a look at the Demo or open a test account. If you have questions, we will help you via the Contact page. You will find the current terms under Pricing.
Sources
- Ordinance on Accounting Records (GeBüV, SR 221.431), Art. 5, Art. 7, para. 1 and Art. 8, as at 1 January 2013: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Federal Act on Data Protection (DSG, SR 235.1), Art. 6, para. 4 and Art. 8, para. 1, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
This guide does not replace legal or tax advice. Information as at 27.10.2026.