Document retention periods in Switzerland

How long should you keep an invoice, a contract or a personnel file? The document retention period for a business in Switzerland depends on the type of document and the rules that apply to it. The Swiss Code of Obligations (CO) sets the main rule for accounting; other rules may apply depending on the area, for example for VAT.

This article sets out the principles and how they translate into IT. It is not legal advice: for a specific case, consult your fiduciary or a lawyer.

Retention period for accounting records: ten years

Article 958f CO requires accounting books and records, as well as the management report and the audit report, to be kept for ten years. The period starts at the end of the financial year: an invoice from March 2025, in a financial year closing on December 31, 2025, is kept until the end of 2035.

Accounting records include in particular invoices received and issued, bank statements, payroll statements and expense receipts. For other documents, such as contracts or personnel files, there is no single period: limitation periods and the rules specific to each area guide the decision.

Electronic archiving: what the law requires

The CO allows records to be kept on paper, electronically or in an equivalent form, provided the link to the underlying transactions is guaranteed and they remain readable at all times. The management report and the audit report follow specific rules. The details are set out in the Ordinance on the Keeping and Retention of Accounting Records (GeBüV in German, Olico in French), whose main principles are:

• Integrity: any modification or deletion must be impossible or detectable.
• Readability: documents remain accessible, with the necessary software, for the entire retention period.
• Documentation: the organization, procedures and archiving tools are described in writing.
• Availability: authorized persons can consult the documents within a reasonable time.
• Verification: storage media are checked regularly and data migrated before it becomes unreadable.

Backup vs. archiving: what is the difference?

The two are often confused. A backup is used to restore a system after an incident; it is replaced over time according to a retention period of a few weeks or months. An archive keeps fixed documents for years and must be able to show they have not been altered.

The two complement each other: the archive itself must be backed up, and an immutable copy, which cannot be changed for a defined period, protects against both a mistake and ransomware.

Deleting personal data that is no longer needed

The nFADP sets the opposite rule for personal data: it is destroyed or anonymized as soon as it is no longer needed for the purposes of the processing. Keeping files on unsuccessful applicants or data on former prospects indefinitely is therefore not prudent.

The two rules work together: an invoice contains personal data, but the legal obligation to keep it for ten years justifies retaining it. When the period ends, it is deleted, including in copies, at the latest when their retention period expires.

Setting up a retention plan

A simple table is enough: document type, legal basis or reason for retention, period, location, person responsible for deletion. Your fiduciary validates the periods; your IT provider turns the table into settings: retention policies in Microsoft 365, read-only archive folders, backup retention periods.

SysPros can configure these settings. Its backups are stored at three ISO 27001 certified sites in Switzerland and can include an immutable copy; the offer specifies the retention, the type of copies and the storage countries. Legal validation of the periods remains a matter for your fiduciary or lawyer.