Document retention calendar 2026 — free download
How many years must a company keep invoices, personnel files or social-security records — and what should be done once the period ends? We have put the answers together in one place. The material is free — we will send it to the e-mail address you provide.
Download the retention calendar (PDF)
We will send the file to your e-mail address — no obligations, no newsletter subscription.
Done — the file is on its way to your inbox.
If the message does not arrive within a few minutes, please check your spam folder. You can also download the calendar right away:
Download the calendar (PDF)What is inside
- A full table of retention periods — accounting and tax, HR and payroll, social security, contracts and sector-specific records (medical, construction, legal).
- How to count the deadline correctly — why five years is not counted from the invoice date and when the period is suspended.
- What to do once the period ends — GDPR requirements, DIN 66399 security levels and the role of a destruction certificate.
- An archive clean-up checklist — seven steps, from listing categories to recording the deletion in your processing register.
The most frequently checked periods
Below is an extract — the full table covers more than twenty categories of documents:
| Type of document | Retention period |
|---|---|
| VAT invoices and accounting records | 5 years |
| Personnel files (employed from 2019) | 10 years |
| Personnel files (employed before 2019) | 50 years* |
| Payrolls and wage records | 10 years |
| Social security (ZUS) documentation | 10 years |
| Patient medical records | 20 years |
* 10 years if the employer filed an OSW/RIA information report with ZUS. Remaining categories — in the full document.
Why it matters
The GDPR works both ways: documents containing personal data must be kept for the required period, but holding them „just in case" afterwards also breaches the storage limitation principle. Once the period ends, documents must be destroyed so that their content cannot be recovered — and the destruction should be documented.
Putting documents in the paper recycling bin does not meet this requirement. Security level P-4 under DIN 66399 is the standard for personal data, and P-5 for specially protected data. The evidence for a data protection audit is a destruction certificate stating the date, scope and method of destruction.
Need to destroy documents after the retention period?
Ekotechnika collects documents from your premises in Warsaw and the Mazovia region, destroys them in line with DIN 66399 and issues a destruction certificate. We handle both one-off archive clean-ups and ongoing cooperation with secure document containers.
Contact: 531 690 670 · bok@niszczeniedokumentow.com