Security & governance
GoBD
The GoBD are the German tax administration's principles for the proper keeping and retention of books, records and documents in electronic form, and for data access by tax auditors. Issued by the Federal Ministry of Finance, they define what an IT system must guarantee for digital accounting records to be accepted in a tax audit.
Where do the GoBD come from?
The GoBD are an administrative letter of the Federal Ministry of Finance, not a statute. The current text dates from 28 November 2019 and has been amended twice, on 11 March 2024 and on 14 July 2025. The retention periods themselves are set in the tax code and the commercial code; the GoBD explain how records have to be kept during those periods when they exist in electronic form.
Which GoBD principles affect storage?
The principles apply to every system that creates, receives or holds tax-relevant records, including upstream systems and archives.
| Principle | What it means | Storage consequence |
|---|---|---|
| Traceability | A third party can follow each transaction from voucher to ledger | Records and their logs kept together and findable |
| Immutability | Entries cannot be changed without the change being visible | Write-once retention or versioning with protected history |
| Completeness | Every transaction is recorded, none removed | Deletion blocked until the retention period ends |
| Machine evaluability | Records stay analyzable by software for the whole period | Original structured formats preserved, not only images |
| Data access | Auditors can read, receive or have data evaluated | Retrieval and export that work years later |
| Procedural documentation | The process and its controls are described in writing | Storage and retention settings documented and current |
What did the 2025 amendment change?
The second amendment, applicable from 14 July 2025, follows the introduction of mandatory electronic invoicing between German businesses on 1 January 2025. For received electronic invoices, the structured data part is what has to be retained, and a match of content is sufficient in place of an identical image. For hybrid formats that combine a readable document with embedded data, the embedded data file must be kept. Electronic business letters and vouchers must be retained in the format in which they were received.
Is a backup enough to meet the GoBD?
No. A backup protects against loss and is expected as part of data security, but the retention duties are an archive function: the original records must stay unaltered, readable and machine-evaluable for the whole period, with access for an auditor on request. That requires a store where retention is enforced per record and where changes or deletions before expiry are either impossible or logged. Personal data inside those records remains subject to the GDPR, so retention and deletion schedules have to be reconciled.
Frequently asked questions
Who issues the GoBD?
The German Federal Ministry of Finance issues them as an administrative letter addressed to the tax authorities.
Do the GoBD prescribe a storage technology?
No. They define outcomes such as immutability and machine evaluability and leave the choice of technology to the organization.
Do the GoBD set the retention periods?
No. Retention periods come from the German tax code and commercial code. The GoBD describe how electronic records must be kept during them.
Related terms
- BSI IT-Grundschutz: the German security methodology.
- GDPR: the data protection rules that apply to the same records.
- Object versioning: keeping every version of a stored record.
- Storage lifecycle management: applying retention and expiry by policy.
- Cloud archive storage: long-term storage for records.