{"id":118270,"date":"2019-11-01T06:02:09","date_gmt":"2019-11-01T05:02:09","guid":{"rendered":"https:\/\/ceadigilaw.org\/deben-las-empresas-archivar-todos-sus-correos-electronicos\/"},"modified":"2026-07-17T16:58:15","modified_gmt":"2026-07-17T14:58:15","slug":"deben-las-empresas-archivar-todos-sus-correos-electronicos","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/en\/blog\/deben-las-empresas-archivar-todos-sus-correos-electronicos\/","title":{"rendered":"Should companies archive all their emails?"},"content":{"rendered":"
\n
\n
\n

In the private sphere, one can decide whether to keep emails and for how long. In the workplace, however, the situation is different. All countries<\/strong>, including our own, have established regulations governing the archiving of<\/strong> commercial emails<\/strong> in the business sphere, with companies being obliged to keep their written communication, including electronic communication, for different periods of time depending on the framework in which they fall (data protection, contractual communication, etc.). Email has largely replaced communication by postal mail or fax, and often represents the only evidence of commercial communication in the event of litigation or other legal proceedings.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n

The obligation to archive commercial emails in Spain<\/h2>\n
\n
\n

Under the Spanish legislative framework, any company<\/strong> that uses electronic means to communicate with partners, employees, suppliers, etc., is obliged to keep and archive emails, not only as a record of a commercial transaction, but also insofar as they contain private data that the Data Protection Agency (AEPD) is responsible for safeguarding. This is how, in addition to the sending and receiving of emails between companies, email marketing campaigns and the sending of newsletters are also included here.<\/p>\n

Nowadays, most business communication is carried out electronically, and documentation is often included in the body of the text itself, and not only as an attachment to the email. Depending on the type of document and communication, there are different legal provisions<\/strong> that oblige companies to keep them:<\/p>\n

    \n
  • Data protection and privacy: Organic Law on Data Protection (LOPD) and the General Data Protection Regulation (GDPR)<\/li>\n
  • Accounting documents: Commercial Code, General Tax Law, Corporate Income Tax Law<\/li>\n
  • Labor relations: order on the individual salary receipt model, Law on Infringements and Penalties in the Social Order<\/li>\n
  • Contractual documentation: Civil Code<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    \n
    \n
    \n

    Spanish rules also provide for retention and limitation periods for a company’s documents which in some cases can be confusing. That is why we help you with this article from our guide on document retention periods so that no deadline slips past you.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    \n

    The LOPD and the protection of private data<\/h2>\n
    \n
    \n

    Business communication today is largely carried out by email, which contains sensitive information that, in the interest of both parties, should be preserved. With regard to personal data, the inbox becomes an information file subject to Organic Law 3\/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPD)<\/strong> and to the LSSI (Law on Information Society Services and Electronic Commerce) and subject to the Spanish Data Protection Agency (AEPD), which has sanctioning power in the event of non-compliance.<\/p>\n

    Basically, the LOPD watches over the security of the user by protecting their private data and, to that end, requires that whoever handles personal data notify the AEPD that they hold personal data and who is responsible for doing so (administrative agency, email marketing software). Article 4 states that personal data must be erased<\/strong> when it is no longer needed for the purpose for which it was collected or requested. In most cases, the limitation periods for infringements, which the LOPD sets out in Article 47, are unknown and, moreover, vary depending on the activity of the organization.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

    \n
    \n
    \n
    \n

    The provisions of the GDPR must also be taken into account, since it in turn regulates which emails may be kept. For example, the archiving of employees’ private emails is only permitted with the express permission of the persons concerned.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    \n

    What the company must do to comply with the LOPD<\/h3>\n
    \n
    \n
      \n
    • Backup copies at least weekly<\/li>\n
    • Keep a backup copy of the email and of the recovery procedures in a location different from where the computer equipment is located<\/li>\n
    • Encrypt the sending and receiving of emails<\/li>\n<\/ul>\n

      Email must be stored in compliance with the legal requirements<\/strong> for retention<\/strong>, location and consultation (the stored information must be accessible if required) and for security<\/strong>, and the appropriate measures must be taken according to the security level associated with the information held (basic, medium and high level). At a basic level of mandatory compliance for all companies are:<\/p>\n

        \n
      • The incident log: there must be a procedure for reporting and managing incidents affecting the personal data contained in emails.<\/li>\n
      • Access control: the company must grant access to email only to those employees who need it for the performance of their duties.<\/li>\n
      • The management of media and documents: the medium on which the company’s emails are stored must allow their classification and inventorying, and be accessible to the employees listed in the company’s security document.<\/li>\n
      • Identification and authentication: the correct identification and authentication of users with access to email must be guaranteed.<\/li>\n
      • Backup and recovery copies: the company must verify every six months the correct definition, operation and application of the procedures for making backup copies and recovering data.<\/li>\n<\/ul>\n

        For more information, you can consult the report prepared by the company Interbel, responsible for distributing the MailServer email archiving software in Spain and, in any case, consult an expert.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

        \n

        Emails containing accounting documentation<\/h3>\n
        \n
        \n

        The following regulations affect all companies and organizations that send invoices<\/strong>, orders<\/strong> or any type of documentation or supporting documents electronically.<\/p>\n

        Article 30 of the Commercial Code<\/strong> establishes that all books, documentation, correspondence and supporting documents must be kept for six years<\/strong>, even if the company or the business owner ceases its activities, even in the event of death (responsibility then falls on the heirs) or in the event of the dissolution of the company.<\/p>\n

        Tax legislation<\/strong> (Articles 66 and 67 of Law 58\/2003 of 17 December, General Tax Law), however, sets other deadlines. Since the period for the Administration to claim debts expires after four years<\/strong>, this is the period of time set in the General Tax Law for keeping books, documents and supporting documents.<\/p>\n

        It should be borne in mind, however, that the Corporate Income Tax<\/strong> Law (Article 25 of Legislative Royal Decree 4\/2004 of 5 March, approving the consolidated text of the Corporate Income Tax Law) allows negative tax bases to be offset for 15 years<\/strong>; therefore, during this time it may request the presentation of the accounts and of supporting documentation.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

        \n

        Archiving emails containing employment information<\/h3>\n
        \n
        \n

        These regulations affect the sending of salary sheets and Social Security registrations or deregistrations<\/strong> by email.<\/p>\n

        According to Article 3 of the Order of 27 December 1994 approving the individual salary receipt model, payslips and contribution bulletins must be kept for a minimum period of five years and, as set out in Article 21 of Legislative Royal Decree 5\/2000 of 4 August, consolidated text of the Law on Infringements and Penalties in the Social Order, everything related to Social Security (affiliation, contributions, registrations, deregistrations, changes) must be kept for four years, as well as the receipts evidencing the payment of salaries and the delegated payment of benefits.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

        \n

        Emails containing contractual information<\/h3>\n
        \n
        \n

        Any message containing an agreement between two parties is considered a contractual document that should be kept for as long as the obligations related to the agreement last. However, the Civil Code (Art. 1930 et seq.) sets a period of 30 years for the limitation of civil actions that may arise from it, even after the contract has expired.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

        \n

        Properly archived emails: a guarantee<\/h2>\n
        \n
        \n

        The law does not specify where commercial emails must be stored, whether on the company’s own server or on an external storage medium, as long as the required measures are guaranteed (complete archiving, protected against the possibility of being tampered with, always accessible, capable of being inventoried and examined).<\/p>\n

        To prevent the review and modification of emails, it is recommended to use a data encryption system<\/strong>, although with the guarantee that, if necessary, they can be delivered decrypted to the corresponding authority.<\/p>\n

        Today there is a large number of programs available for archiving emails, many of which, thanks to software for automatically storing emails in the cloud or on physical servers<\/strong>, represent considerable time savings.<\/p>\n

        A frequent mistake made by many companies, due to the huge volume of incoming and outgoing emails, is to archive absolutely all messages in order to save themselves the selection process, but this decision may be infringing the Personal Data Protection Law. Employees’ personal emails<\/strong> cannot be kept precisely for this reason, unless the employee has unequivocally declared their consent in this regard. Otherwise, or if the company is not interested in requesting this permission from its employees, there are two options: completely prohibiting the use of corporate email for personal purposes, the safest variant to protect against penalties, or allowing employees to use mobile devices or webmail programs.<\/p>\n

        In short, it is very important for companies to have a mechanism in place to retain email in accordance with the periods established by legislation which, at times, can be confusing. That is why this article is not intended to replace advice from a professional, but rather to offer a general overview from which to consult a competent authority.<\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

        In the private sphere, one can decide whether to keep emails and for how long. In the workplace, however, the situation is different. All countries, including our own, have established regulations governing the archiving of commercial emails in the business sphere, with companies being obliged to keep their written communication, including electronic communication, for different […]<\/p>\n","protected":false},"author":2,"featured_media":5860,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1107],"tags":[],"cea_women":[],"class_list":["post-118270","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection-privacy"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/comments?post=118270"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118270\/revisions"}],"predecessor-version":[{"id":119222,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118270\/revisions\/119222"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media\/5860"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media?parent=118270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/categories?post=118270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/tags?post=118270"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/cea_women?post=118270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}