How is GDPR's storage limitation principle reconciled with the technical need to keep projects for civil liability purposes?

Art. 5(1)(e) GDPR requires personal data to be kept only for as long as necessary for the purposes of the processing. That does not mean data cannot be kept longer: it can be kept if there is a legal basis justifying it, such as compliance with legal obligations or the exercise of civil claims. Retention for professional civil liability (LOE actions, ordinary civil limitation, tax retention) is fully covered by legal obligation (art. 6(1)(c) GDPR) or by the legitimate interest of the controller in defending against claims (art. 6(1)(f) GDPR). What GDPR does require is: document in writing the periods by block, not keep more than what the specific purpose justifies, separate active files from retention files, restrict access to the historical archive to authorised personnel only, and proceed to secure destruction when all relevant periods have expired. The firm's archiving policy is the document that articulates this balance.

Retention of architecture projects and licences: deadlines vs GDPR

Q: How long does an architecture firm have to keep completed projects?

There is no single period: it depends on several rules that coexist over the same documentation. As a general benchmark, the architect's civil liability for defects in the works is governed by the periods of art. 17 of the Spanish Building Code (LOE — Ley 38/1999 de Ordenación de la Edificación): one year for finishes, three years for habitability and ten years for structural defects, counted from acceptance of the works. The action to claim damages must be brought within two years of their appearance. In practice, this means the firm should keep the technical documentation of the project at least for the LOE periods plus the limitation period for the action, which usually reaches a horizon of twelve to fifteen years. Add the accounting and tax periods of the financial documentation (six years under the Spanish Commercial Code, four years general tax limitation) and the specific periods of each professional college. The sensible firm's rule of thumb is to keep the complete file for fifteen years from acceptance of the works; past that period, assess destruction of what no longer adds evidential value.

Q: Is it mandatory to keep signed and visa'd drawings for the building's whole life?

No. The firm is not the building's permanent archive. The retention obligation is governed by the applicable legal periods (professional civil liability, tax limitation, accounting rules). Past those periods, there is no general obligation to keep signed drawings indefinitely at the firm. Visa'd drawings also remain in the corresponding professional college's archive; in many cases, the college's historical archive is the most complete and durable source. Specific longer periods do exist for assets of cultural interest, protected buildings or projects subject to special sectoral regulation (energy, health, defence, etc.). For ordinary projects, the usual professional retention horizon (twelve to fifteen years from acceptance) is enough. Good practice is to document internally the archiving and destruction policy, with clear periods by block of the file.

Q: What to do with old projects when the firm ceases activity, merges or the architect retires?

Cessation of activity does not extinguish still-running retention obligations. Projects whose civil liability period is still running and financial documentation within the accounting and tax periods must be kept securely for the remainder of the applicable horizon, even if the firm has closed or the professional has retired. The sensible options are: organised personal custody by the architect who ceases (feasible where the volume is manageable and security measures are maintained), deposit with a professional document custody service under an art. 28 GDPR contract, voluntary deposit in the professional college's archive where this is allowed (some colleges accept ad hoc deposits or deposits of notable works), or orderly transfer to a successor firm where there is continuity of activity. What is not sensible is to destroy documentation whose retention period is still running, or to abandon it on insecure media. The decision should be taken in good time, ideally when planning cessation, and recorded in an internal minute documenting what has been done with each file.

Few professions accumulate as much documentation per client as architecture. An average new-build or refurbishment project easily generates several gigabytes between drawings, reports, annexes, existing-condition photographs, CAD/BIM files, certifications, licences and technical correspondence. Multiplied by tens or hundreds of projects across a professional career, a firm's archive becomes an important asset and, simultaneously, a responsibility under GDPR that few firms have ordered with legal honesty.

This guide explains how to reconcile the professional retention required by Spain's Building Code (LOE — Ley 38/1999 de Ordenación de la Edificación), civil limitation, accounting and tax obligations and professional college rules, with the storage limitation principle of art. 5(1)(e) GDPR.

The false conflict between GDPR and professional retention

A common mistake in the sector is to assume that GDPR requires destruction of projects after a short period. It does not. Art. 5(1)(e) GDPR provides that personal data shall be kept "for no longer than is necessary for the purposes of the processing", but the purpose is not only to draft the project: it also includes defending against potential claims from the client, complying with legal obligations and, where appropriate, keeping documentation of professional college or cultural interest.

GDPR does not conflict with these periods. What it requires is:

Identifying the specific purpose of retention beyond project close-out: professional civil liability, limitation of client actions, accounting and tax obligations.
Documenting the legal basis of the retention: legal obligation (art. 6(1)(c) GDPR) for the rules that impose it; legitimate interest (art. 6(1)(f)) for defence against claims.
Limiting retention to what is strictly necessary: not keeping everything for the longest period, but applying differentiated periods by block.
Separating active from archived files: documentation of active projects is not mixed with that of the historical archive.
Restricting access to the historical archive to authorised staff.
Destroying securely when all relevant periods have expired.

The four periods coexisting over the same project

As a general benchmark, at least four different retention frameworks coexist over the documentation of an architecture project:

Rule	What it covers	General horizon
LOE art. 17	Civil liability for defects: 1 year (finishes), 3 years (habitability), 10 years (structural) from acceptance.	Up to 10 years from acceptance + 2 years of limitation
Spanish Civil Code art. 1964	General limitation of personal actions not specifically regulated.	5 years
Spanish Commercial Code art. 30	Books, correspondence, documentation and supporting records of the trader.	6 years from the last entry
Spanish General Tax Act	General tax limitation.	4 years (extendable to 10)
Professional college rules	Specific periods of the applicable professional college.	Variable

The sensible firm's rule of thumb is: keep the complete file for fifteen years from acceptance of the works. That covers the ten LOE years for structural defects plus the two years of limitation of the action, with an additional margin. Past that period, and absent specific operations that extend it (live litigation, open administrative files), the documentation that no longer adds evidential value should be destroyed.

Firm's archiving and destruction policy

The key document for managing retention is the internal archiving and destruction policy. It need not be a treatise: two or three clear pages answering the basic questions:

What is kept: by blocks of the file (project technical documentation, licence documentation, works documentation, final certification, financial documentation, client communications, supplier communications, CAD/BIM backups).
For how long: period per block, with the associated legal basis.
Where: physical location (cabinet, outsourced archive, professional custody service) or digital (professional cloud with signed DPA, encrypted internal NAS).
Who accesses: by block and by phase (active vs historical archive).
How it is destroyed: shredder with appropriate security level for paper, secure wipe for digital files, certified destruction contract with a professional service where outsourced.
Who decides destruction when periods expire.
How destruction is documented: internal minute with date, destroyed file and signature.

Active archive vs historical archive: the separation that matters

A good organisational practice that also satisfies GDPR is to physically or logically separate the active project archive from the historical archive:

Active archive: projects under design, in visa, on site, in guarantee period. Accessible to the technical team intervening at each moment. Living documentation.
Historical archive: completed projects with accepted works. Access restricted to the firm's principal or to expressly authorised staff. Documentation in "retention by liability" state with no regular operational use.

The separation reduces the risk of unnecessary exposure of old personal data, simplifies the application of reinforced security measures to the historical archive, facilitates audits of what is kept and why, and paves the way for orderly destruction when the time comes.

"GDPR does not require destroying ahead of time. What it requires is to have thought through and documented why each item is kept, for how long, where and who accesses it. An orderly historical archive is worth more than a massive archive without a policy: the first defends you against a claim; the second complicates your defence because you don't even know what you have."

Mario P. Talamillo · Managing Partner, Certix®

Digital archive: backups, formats and migration

Keeping digital files for fifteen years has an operational problem few firms plan for: formats and media evolve. A .dwg file from twelve years ago may not open correctly with the current software version, and a hard drive from a decade ago may be unreadable. Sensible good practice:

Keep in open and durable formats whenever possible: PDF/A for documents, IFC for BIM, DXF as a complement to DWG.
Periodic migration: every so many years, migrate files to current media and formats. Do not wait for the medium to fail.
Integrity verification: periodically check that historical archive files remain readable.
Double copy: one on own infrastructure (encrypted NAS), another in professional cloud with a signed DPA.
Professional document custody platform for firms with high volume or critical documentation.

Physical documentation: the side that ages worst

The physical archive (original signed drawings, paper files, site files) raises specific challenges:

Space: takes up more every year. Without an orderly destruction policy, the firm ends up renting physical space for documentation that no longer adds value.
Security: lockable cabinets, control over who has access, log of consultations of the historical archive.
Preservation: damp, sunlight, pests. Fifteen-year retention requires reasonable environmental conditions.
Digitisation: convert old files to digital format to free physical space and facilitate destruction of the original where appropriate, while maintaining the security measures of the digital archive.

Cessation of activity: the moment almost nobody plans

The cessation of a firm's activity (retirement of the principal, dissolution of the company, merger, exit from the professional regime) does not extinguish still-running retention obligations. Documentation whose period has not yet expired must continue to be kept securely. The sensible options:

Organised personal custody by the principal who ceases, where the volume is manageable and security measures are maintained.
Deposit with a professional document custody service under an art. 28 GDPR contract covering the remaining retention period.
Voluntary deposit in the professional college's archive where the college allows it.
Orderly transfer to a successor firm where there is continuity of activity and a suitable documentary assignment is signed.

What is not sensible is to destroy documentation whose retention period is still running, or to abandon it on insecure media. The decision should be taken in good time, when planning cessation, and recorded in an internal minute documenting what has been done with each block of the historical archive.

Professional retention checklist

Internal archiving and destruction policy documented in writing.
Differentiated periods by block of the file (technical, financial, communications, works).
Physical or logical separation between active and historical archive.
Restricted access to the historical archive with consultation log.
Art. 28 GDPR contract with the digital archive platform and, where used, with the professional document custody service.
Periodic migration of digital formats and media to preserve readability.
Documented secure destruction procedure with internal minute.
Cessation plan providing for custody during pending periods.
Annual review of the historical archive to destroy items whose periods have all expired.

Frequently asked questions

How long does an architecture firm have to keep completed projects?

Several periods coexist: art. 17 LOE sets civil liability of 1, 3 and 10 years for defects by type, counted from acceptance, plus 2 years of limitation to bring the action. Add the Spanish Commercial Code (6 years) and the Spanish General Tax Act (4 years general limitation). Rule of thumb: keep the complete file for fifteen years from acceptance of the works; past that period, and absent live litigation, assess destruction.

Is it mandatory to keep signed and visa'd drawings for the building's whole life?

No. The firm is not the building's permanent archive. The obligation is governed by the legal periods (civil liability, tax limitation, accounting rules). Visa'd drawings remain in the professional college's archive. For ordinary projects, the fifteen-year horizon from acceptance is enough. Specific longer periods exist for protected cultural assets and projects with special sectoral regulation.

How is GDPR's storage limitation principle reconciled with retention for civil liability?

Art. 5(1)(e) GDPR does not prevent longer retention where a legal basis exists. Retention for professional civil liability, LOE actions and tax retention is covered by legal obligation (art. 6(1)(c)) or legitimate interest (art. 6(1)(f)). GDPR requires documenting periods by block, not keeping more than is justified, separating active from historical archive, restricting access and destroying securely when all periods have expired.

What to do with old projects when the firm ceases activity, merges or the architect retires?

Cessation does not extinguish still-running retention obligations. Sensible options: organised personal custody by the principal, deposit with a professional document custody service under an art. 28 GDPR contract, voluntary deposit in the professional college's archive, or transfer to a successor firm. The decision should be taken when planning cessation and recorded in an internal minute.

This content is for general guidance only and does not constitute specialist legal advice. Application of the rules to any specific case requires individual analysis. Spanish regional sectoral regulations may extend or modify periods and requirements.

Does your firm have a clear archiving and destruction policy?

At Certix we assign you a compliance specialist for the architecture sector. No commercial intermediaries, no generic templates.

Speak to a specialist

Retention of architecture projects and licences: legal periods vs GDPR