GOBD

From https://translate.googleusercontent.com/translate_c?act=url&depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=auto&sp=nmt4&tl=en&u=http://www.bundesfinanzministerium.de/Content/DE/Downloads/BMF_Schreiben/Weitere_Steuerthemen/Abgabenordnung/Datenzugriff_GDPdU/2014-11-14-GoBD.pdf%3Bjsessionid%3DEF01E79A269CAF077068F16B7DF2C5E1%3F__blob%3DpublicationFile%26v%3D3&usg=ALkJrhgyq0JxxmUBHaFn79QRamB6Mkf-1A#37:

Principle of traceability and verifiability (see under 3.1),
• Principles of truth, clarity and continuous recording (cf.
Under 3.2):
▪ Completeness (see under 3.2.1),
▪ correctness (see under 3.2.2),
▪ timely bookings and records (see under 3.2.3),
▪ Order (see under 3.2.4),
▪ Unchangeability (see under 3.2.5).

These principles must be demonstrable during the period of the retention period
Are met and maintained.

The verifiability of the books and other records required
A meaningful and complete procedural documentation (see under 10.1), the
Both the current and the historical procedural content for the duration of the
Storage time and the versions of the DV-System.

3.2.1 Completeness (Section 146 (1) German Civil Code, Section 239 (2) HGB)
36 The transactions are to be recorded in full and complete (principle of the
Single record keeping). A complete and complete record of
Business transactions are also given when permissible not all data fields
Of a data record.

Not be lost, For example, by sequentially numbering the
continuous and outgoing invoices, by depositing in special folders and
Folders or electronic ground (book) records in POS systems,
Inventory management systems, billing systems, etc

A reservation or a recording can not be changed in a manner
that the original content is no longer detectable. Even such changes
may not be made, the nature of which makes it uncertain whether they
were originally or only later made (§ 146 paragraph 4 AO, § 239
Paragraph 3 HGB).
59 changes, and deletions from and to electronic booking or up
drawings (cf. RZN.. 3 to 5) must therefore be logged so that the advantages
Suspensions of § 146, paragraph 4 AO or § 239, paragraph 3 HGB are met (see
under 8). Electronic documents and other electronic documents
gem. § 147 AO storage fee and not reservations or records
are, the same applies, mutatis mutandis

Each transaction is to demonstrate original or a copy of the original. is
no external evidence available, a proper receipt must be created. Purpose of evidence
It is safe and clear evidence of the relationship between the
Operations in reality the one hand, and the recorded or booked in content
Books or other records required and justified the other hand,
to provide (document function). it does not depend on the designation as "proof"

From the procedural documentation (see 10.1) must be seen as the
electronic documents collected, received, processed, outputted and stored
are (for storage see 9).

!!!PROCEDURAL DOCUMENTATION!!! (the programs internal rules)

Messages with their complete data content the document function and must comply with
stored its full content and stored

Unique document number (eg. As index, Paginiernummer, document ID, continuous Rechnungsausgangs-number), document date.

detection or confirmation that the Vorschrif- contained in the documentation
ten have been subject to an unauthorized modification procedures (including access
protection, versioning, test and release procedures)
• evidence for the use of the approved process and
• Proof of actual implementation of the individual postings

All transactions must chronological order by
and material recorded with their proper and recognizable content.
among the recording paid content
• in RZN. Information contained 77, 78 and 79,
• the acquisition date, if different from the booking date

Through acquisition, transmission and processing checks is to ensure
that all transactions are fully recorded or transmitted and then
without authorization (that is, not without access protection method) and not without proof of
previous state can be changed. The implementation of the con-
checks should be recorded. The specific configuration of the logging is depend
gig on the complexity and diversification of business and organization
tion structure as well as the used DV system.

Maintaining the link between index and electronic document management must be guaranteed throughout the storage period. It is ensure that the electronic document comparable with the allocated Index can be managed.

Incoming electronic trade or business letters and supporting documents must
(Z. B. be stored in the format in which they were received invoices
or bank statements in PDF or image format). Conversion to another research
mat (z. B. MSG in PDF) is allowed when the machine readability not
is restricted and no substantive changes are made (seven
heart. 135). Takes place an enrichment of the image information, such. B. (by OCR examples
game: generating a volltextrecherchierbaren PDF file in the acquisition process)

With the use of cryptographic techniques is to ensure that the encrypted
Documents in the DV system are available in decrypted form. Become
Signature verification using the keys used are kept.
The storage obligation ends when none of the signed with the keys under-
were more must be kept

For tax purposes is not an electronic signature or a timestamp required

continue on page #32




From Ole:

- archive for 10 years
- encryption of emails
- hash value to show that email is unaltered
- keep attachments in original format
- archived emails must be indexed and searchable + easy to retrieve
- emails must be stored unaltered
- emails must NOT be stored in the mail program, they must be stored in the cloud or in a local special software
- they must be saved in a secure environment (=emails cannot be edited, and all editing and access must be logged)
- document how the business archives its emails and how to handle access to the archive system
- gov. authorities must get full access to the archive to search anything


https://www.bundesfinanzministerium.de/Content/DE/Downloads/BMF_Schreiben/Weitere_Steuerthemen/Abgabenordnung/Datenzugriff_GDPdU/2014-11-14-GoBD.pdf;jsessionid=BC10AB33F4B6EC9C66BF13AEBFC177BA?__blob=publicationFile&v=3

https://blog.microfocus.com/gobd-2017-darum-sollten-sie-ab-januar-ihre-e-mails-archivieren/?lang=de

https://testen.lexoffice.de/gobd.php?cid=163&adword=google_lo/20_GoBD/02_gobd_%22%22/Gobd&gclid=CjwKEAjwytLKBRCX547gve7EsE4SJAD3IZV6YP563BwLAXMv20VtQY0cCozQBNU6FHmbUIOtp4K_1hoCaWfw_wcB


Email: Backup Alone Is Not Enough (https://www.mailstore.com/en/blog/2016/08/31/email-backup/)
31/08/2016 | Wilm Tennagel
Backups cannot replace archiving and email archiving is not capable of replacing traditional backup tasks.

Emails are the number one means of business communication. As such, they contain business-related data. Various national laws all over the world require legally compliant archiving, while IT security strategy calls for backing up the email server. IT decision-makers should take care not to overlook data protection in the process.

[...]

In view of these numbers and the legal requirements for archiving business emails, IT decision-makers are required to integrate email archiving into their strategic IT planning. This is because the increase in electronic correspondence has resulted in large volumes of data that need to be backed up and archived in a legally secure manner due to their business relevance. When dealing with globally active companies, IT decision-makers should not overlook the fact that compliance requirements differ from country to country. The legal requirements are especially strict in the DACH region.
The difference between backup and archiving

IT supervisors are on thin ice when they rely on the following principle: “We already back up our email server, so there’s no need to archive separately.” Backup is no substitute for legally compliant archiving! The basic idea behind every archiving operation is to ensure that data is retrievable and available, even over a long period of time. Companies process invoices, quotes, and requests for support and appointments via email day in, day out. In Germany for instance the GoBD requires that these emails be fully available at all times over many years in their original, tamper-proof form. This is precisely what email archiving does and what differentiates it fundamentally from a backup, whose sole purpose is to secure important data within a limited time period and to preserve it so that it can be restored as needed. Backups on external data storage devices cannot satisfy this requirement because they cannot ensure complete, tamper-proof storage of all emails, as the emails can be deleted immediately upon receipt or before a backup. In contrast, a professional email archiving solution stores exact copies of all emails in a central archive to ensure the availability of any amount of data for many years to come. Measures such as hash values and encryption ensure legally mandated protection against tampering. For example, users can also access their emails in Microsoft Outlook and quickly search, find, and restore them using full-text indexing, thanks to seamless integration.

[...]

Backups cannot replace archiving and email archiving is not capable of replacing traditional backup tasks. It goes without saying that backups remain important, as even legally compliant archives need to be backed up. There is no escaping the fact that the IT strategies of security-minded CIOs and IT supervisors should not fail to include backups as well as legally compliant email archiving in order to ensure swift and complete disaster recovery and to avoid legal risks.