How long to keep a client’s data

Common indicative periods in Spain

• Accounting books, invoices and records: 6 years (Commercial Code, article 30).
• Records with tax effects: at least while the tax authority can review them, generally 4 years (General Tax Law, article 66).
• Employment and social security records: 4 years (Law on Social Order Infringements and Penalties, article 21).
• Anti-money laundering, for professionals subject to it: 10 years (Law 10/2010, article 25).
• Job applications: until the recruitment process ends, unless the person agrees to be considered for other roles.
• Enquiries and contact forms: as long as it takes to reply and follow up.

These are indicative periods. They depend on your activity and may change, so confirm them with your adviser for your case. Other countries have their own rules.

A form is not your archive

Long periods, like those for invoices, apply to the records you keep in your practice software or archive, not to the form response in which someone asked you for something. It makes sense to move the data you need to its place and let the form delete the response after a short period.

How to automate it

• Choose a retention period for each form according to its purpose: for example, 3 months for enquiries and 6 months for job applications.
• Peachform checks the periods every day and deletes expired responses and their files.
• Before they are deleted, export to CSV or save as PDF whatever you must keep.

Templates to start with

• 💼Job applicationFor small businesses that are hiring: the applicant's details, role, CV and availability.
• 📚Initial consultation for law firmsFor lawyers and law firms: area of law, deadlines and a summary before the first meeting.
• 📦Client onboarding for accountantsFor accounting and tax firms: tax details, the services needed and the first documents.

Frequently asked questions

What if I keep the data longer?

Keeping data you no longer need breaches the GDPR’s storage limitation principle and increases the harm if there is a security breach.

Do I have to state the period on the form?

The period, or the criteria used to set it, is part of the full information in your privacy policy.

Can deleted responses be recovered?

No: deletion by retention period is permanent. Export first whatever you want to keep.