Closing a file is not deleting it: how long to keep each part

Every firm has a cupboard — physical or on a server — of files closed ten or fifteen years ago that nobody dares touch. The reasoning is understandable: deleting something you later need is worse than keeping too much. But the reasoning no longer holds. Keeping without a time limit breaches the GDPR’s storage limitation principle, and destroying without criteria leaves the firm defenceless against a negligence claim.

The question “how long do we have to keep a file?” has an awkward answer: there isn’t one. There is no retention period for “the file”. There are periods for each thing inside it, with different legal bases, starting at different moments. Closing a file needs a retention plan by document category, not a number. A firm that applies a single figure — “ten years and out”, “six years”, “forever” — is almost certainly wrong for some category, in one direction or the other.

The five sets of rules that set the periods

Ley 10/2010, the anti-money laundering act. Lawyers are obliged entities when they take part in the transactions listed in article 2.1.ñ, including property purchases and setting up or managing companies. Article 25 requires the documentation of compliance to be kept for ten years: copies of customer due diligence documents and the records evidencing transactions, counted from the end of the business relationship or the execution of the one-off transaction. Two nuances almost nobody applies. First, after five years that documentation may only be accessible to the firm’s internal control function and, where relevant, to whoever handles its legal defence. Second, the article says that after ten years the documentation is deleted. It is not optional.

The General Tax Act (LGT). Article 29.2.e lists, among formal obligations, keeping invoices, documents and supporting evidence. Article 66 sets four years as the limitation period for the tax authority’s right to assess and to collect, and article 67.1 runs it from the day after the filing deadline. Four years from the end of the filing period, not from the invoice date: an invoice from September 2022 counts from 21 October 2022, the day after the Q3 VAT return was due. And the period is interrupted by any action of the authority or of the taxpayer, so a formal request restarts the clock.

The exception worth knowing is article 66 bis: the right to review tax losses carried forward or pending deductions expires after ten years, and a taxpayer offsetting them must still produce the returns and accounts in which they arose.

The Commercial Code. Article 30 requires books, correspondence, documents and supporting evidence to be kept for six years from the last entry. It affects a firm set up as a professional company: Ley 2/2007 allows any corporate form and applies the rules of the chosen form as a fallback, and a professional SL keeps commercial accounts like any other SL. An individual lawyer is outside article 30, but subject to the record-keeping duties in tax rules.

The Civil Code. A lawyer’s liability to a client is, as a rule, contractual. Since the 2015 reform (Ley 42/2015), article 1964.2 sets five years for personal actions with no special period, counted from when performance could be demanded. This is the period that governs the firm’s own exposure, and the hardest to compute: the starting date is argued case by case, and when the harm surfaces years after the matter, the clock may start much later than the firm assumes.

GDPR and the Spanish Data Protection Act (LOPDGDD). Article 5.1.e GDPR requires data to be kept in identifiable form “for no longer than is necessary”. Article 17.3.e excludes erasure where processing is necessary for the defence of legal claims. And article 32 LOPDGDD adds a specifically Spanish concept: blocking. On erasure, the controller blocks the data — identifies and sets them aside, prevents any processing including viewing — and makes them available only to courts, prosecutors or competent authorities, for the limitation period of any liability. After that, destruction.

The retention table

Category	Period	Legal basis	When it expires
Due diligence and ID (AML)	10 years from end of relationship or transaction; restricted access from year 5	Art. 25 Ley 10/2010	Deletion
Invoices and tax evidence	At least 4 years from end of filing period, longer if interrupted	Arts. 29.2.e, 66, 67 LGT	Secure destruction
Accounts and evidence (professional company)	6 years from last entry	Art. 30 Commercial Code	Secure destruction
Returns and accounts behind tax losses or pending deductions	While being offset; review up to 10 years	Art. 66 bis LGT	Keep until used up
Defensive core of the file	While liability can be claimed; contractual action, 5 years from when it could be brought	Art. 1964.2 Civil Code; art. 17.3.e GDPR	Block, review on a set date
Other personal data (duplicates, drafts, third-party data)	As long as needed for the purpose	Art. 5.1.e GDPR	Erasure with blocking, art. 32 LOPDGDD
Client originals	Not kept	—	Returned at closing, with receipt

Two rows need comment. The “defensive core” is what the firm would need to defend a claim: the engagement letter, the advice or report delivered, the correspondence in which a risk was flagged or client instructions received, and the final document or filing. Not the fourteen drafts or the passport copies. And client originals are not the firm’s: they go back at closing, and the signed receipt joins the defensive core.

A 2016 file, reviewed in October 2026

A firm set up as a professional company advised a Danish client in 2016 on buying a flat in Marbella. Engagement signed in February; deed executed on Tuesday 15 March 2016; transfer tax and registration in the following months; file closed and fee note issued on 30 June 2016. The client never came back. What can be destroyed now?

Due diligence. It was a one-off transaction executed on 15 March 2016. The ten years expired on 15 March 2026 and, even counting from the June closing, they have passed. The passport copy, the source-of-funds questionnaire and the transfer receipt must be deleted, unless an open request or proceeding concerns them. Had the client returned in 2021 to make a will, the business relationship would have stayed alive and the period would run from its end: the client’s matter history decides, not the date of the first file.

Invoice and tax. The June 2016 fee note went into the Q2 VAT return, due on 20 July 2016: barring interruption, time-barred in 2020. The company’s 2016 corporate tax was filed in July 2017: time-barred in 2021. The 2016 accounts, under the Commercial Code, six years after that year’s last entry: in practice, 2023. All expired, with one exception: if the company generated tax losses in 2016 and is still offsetting them, the 2016 return and accounts are kept for as long as the offsetting lasts, and the authority’s right to review them runs to July 2027.

Professional liability. This is the hard call. Five years from 2016 lands in 2021, and the temptation is to destroy everything. But if the client discovers in 2026, while trying to sell, a charge or a planning irregularity the firm should have flagged, he will argue the claim could not be brought until then. Without the land registry extract that was obtained, the report that was delivered and the email warning him of the risk, the firm defends itself from memory.

The outcome in 2026: the due diligence documentation is deleted; drafts, duplicates and the invoice are destroyed; and the defensive core is blocked, with a review date and a written reason. A small fraction of the original volume still exists, but it is no longer in the folder tree the whole team browses.

Destruction is a procedure too

Secure destruction matters as much as the period. Paper through a certified provider, with a destruction certificate; digital files removed from backups and from laptop syncs as well. And a current warning: a file that should be blocked but is still indexed in a search or AI tool is still being processed, with all the professional secrecy problems that implies. A lost or exposed old archive is a breach with its 72-hour clock, even if nobody has opened it in a decade.

The retention table belongs in the record of processing activities the GDPR already requires, and the AML part in the firm’s procedures manual, covered in our Ley 10/2010 compliance guide and the piece on KYC for lawyers.

How Mandato helps

In Mandato, documents live inside each case file, and due diligence documentation lives in the compliance module, separate from the legal work. That separation is what lets the firm apply each part its own period when the matter closes, instead of treating the folder as one block. Review dates go into the calendar like any other deadline. What to keep, and until when, remains the firm’s decision; the tool is there so that the decision is taken and recorded on the day the file closes, not ten years later.