Invoices and contracts booked in December 2021 hit their five-year tax retention deadline on 31 December 2026, and holding the personal data in them past that date is its own GDPR breach.
Why It Matters
KSeF keeping a structured invoice for ten years does not excuse the business from its own duty: once the five-year tax retention window closes, invoices, contracts and files that name a sole trader, contractor or private client can no longer be kept without a legal basis under GDPR's storage-limitation principle. Most firms have never run this check and are sitting on years of documents nobody has cleared.
What To Do About It
Before the year-end scramble, pull every invoice and contract booked in 2021, separate what still carries personal data, and destroy or anonymise anything past its legal basis, shredded paper for physical files, permanent deletion for digital ones. Repeat this as a yearly task, not a one-off.
Related Signals
A cyberattack on MyDr, medical scheduling software used by 12,000 Polish clinics, exposed close to 19 million PESEL numbers plus visit and prescription histories.
13 Aug 2026
Poland's data protection authority fined a door-to-door sales partner of Energa-Obrot for letting reps trade customer contract scans over personal WhatsApp with no oversight.
7 Aug 2026Germany's BSI set 31 July 2026 as a de facto NIS2 registration deadline, with only about 18,500 of an estimated 29,000 to 40,000 affected companies registered by late May.
28 Jul 2026