Document Management and GDPR: what you need to know

A document management system almost inevitably processes personal data – names on invoices, addresses in contracts, salary data in personnel files. This means GDPR obligations apply: you need secure processing, regulated access, a contract with the provider, and a concept that clearly separates retention obligations from deletion obligations.

Why DMS is automatically a data protection issue

GDPR does not distinguish between “database” and “document storage”. A scanned letter with a sender’s name is just as personal data as a CRM entry. Whoever stores documents centrally, makes them searchable, and shares them with the team processes this data – and must do so responsibly. This is not a reason against a DMS; quite the opposite: a central, regulated filing system is much easier to operate in compliance with GDPR than scattered folders, local copies, and private email inboxes.

The five most important evaluation points when choosing

• Hosting location and applicable law: Where do the data physically reside, which law applies to the provider? Hosting in Germany or the EU saves you the review of third-country transfers.
• Data Processing Agreement (DPA): The provider stores documents on your behalf and is therefore usually a data processor. Without a DPA, the contractual foundation is missing.
• Access control: Not everyone on the team needs to see everything. Pay attention to roles and visibility rules – personnel files belong in different hands than incoming invoices.
• Encryption and secure login: Transmission encrypted, access protected – for example via one-time codes instead of shared passwords.
• Traceability: It should be clear what happened to documents. This also helps with access requests from data subjects.

The tension: delete vs. retain

GDPR requires you to delete personal data once the purpose is no longer applicable. At the same time, tax and commercial law require you to retain documents for years. The resolution: legal retention obligations are a separate legal basis – tax-relevant documents remain in the archive until their period expires. Then the deletion obligation applies. A good DMS supports exactly this lifecycle: defined retention instead of “just sitting there”. How immutable archiving works is explained in the article Audit-Proof Archiving.

How webRichtung documents implements this

webRichtung documents combines filing, email import, batch processing, and archive search in one documents area. This lets you implement and audit your organizational rules for intake, retention, and access in one central place instead of distributing documents across local folders. Details on how to use it can be found in the documentation.

Practical getting started

Start with a brief inventory: what types of documents with personal reference do you have (receipts, contracts, personnel files)? Who needs access to what? What retention periods apply to each type? With these three answers, you can evaluate a DMS in a structured way – and document the implementation clearly in case the supervisory authority asks. Also define how access ends when someone leaves the team. These central guardrails make a case for a shared operating system rather than locally copied folders whose whereabouts no one can track anymore.

This article provides general information and is not a substitute for legal or tax advice.