Does the self-employed professional have to keep the client's DNI or tax ID on every invoice issued?

The Spanish Invoicing Regulation (Royal Decree 1619/2012) requires the full invoice to include the name or company name and the tax ID of the recipient where the recipient is a trader or professional, or where it is an intra-Community transaction. In ordinary B2C operations (sale or service to a final consumer), it is enough to record the client's name and the data essential to identify them, without needing to ask for the DNI except in the case of a simplified invoice with full details when the amount requires it. The practical rule is: ask for the tax ID when the client needs it to deduct the expense and the transaction requires it; do not turn into routine the asking of every retail client's DNI when they do not require it. The minimisation principle of Art. 5(1)(c) GDPR requires not to collect data that is not necessary for the purpose.

Are cloud copies of invoices (Dropbox, Google Drive, iCloud) lawful for an autónomo?

Yes, provided two conditions are met. First, the cloud provider acts as processor over the data of the autónomo and their clients; the Art. 28 GDPR contract offered by the provider itself in its terms must be signed (Dropbox Business, Google Workspace, iCloud for professionals, OneDrive for Business). The free or personal versions (Dropbox Basic, personal Drive, personal iCloud) do not include that contract and are technically not suitable for storing professional client data. Second, the location of the data must be assessed: most of these providers have servers outside the European Economic Area, which triggers the safeguards of Chapter V GDPR (Data Privacy Framework for the United States where in force, standard contractual clauses). The recommended use is Google Workspace, OneDrive for Business, Dropbox Business or an equivalent European service, with encryption enabled and a separate folder for professional use.

What happens to the client's data when the self-employed professional ceases activity or retires?

Ceasing activity or retiring does not eliminate retention obligations that are still in force. Accounting and tax documentation must be retained for the periods of the Spanish Commercial Code (six years from the last entry) and of the Spanish General Tax Act (a general four-year limitation period, extendable depending on the case), even if the activity has ended. The autónomo who ceases activity must organise the archive and keep it securely for the remainder of the period: at their own home if they feel up to it, in a professional document custody service, or, most commonly, by instructing the gestoría (Spanish accountancy/advisory firm) to retain the documentation for the remaining periods under an Art. 28 GDPR contract covering that phase. Once all periods have elapsed, secure destruction is appropriate (shredding of paper, secure erasure of digital files) and, if it was the last responsible person, formally deregistering any professional database.

Invoicing and retention of tax data for the self-employed: how long to keep records and how

Q: How long does a self-employed professional have to keep invoices issued and received?

Retention periods combine several rules that coexist over the same documentation. As a general reference, Art. 30 of the Spanish Commercial Code sets a six-year period for books, correspondence, documentation and supporting records of the trader, counted from the last entry. The Spanish General Tax Act sets general limitation periods of four years for tax debts; where negative tax bases or pending tax credits are being carried forward, the period may extend to ten years. For ordinary civil claims, Art. 1964 of the Spanish Civil Code sets five years. The practical rule for the autónomo (self-employed professional in Spain) is to retain billing for at least six years from the last accounting entry; once that period has elapsed and in the absence of specific operations extending the deadlines (a tax inspection in progress, a live civil claim), deletion is in order.

The invoices issued and received by an autónomo (self-employed professional in Spain) concentrate most of the personal data that passes through the activity. Name, tax ID, address, amount, description of the service and sometimes the client's bank account. Keeping that documentation is mandatory for several years for accounting, tax and civil reasons. But keeping it in any old way —in a desktop folder, in a personal Dropbox, in an unsorted email account— is not what the GDPR requires.

This guide explains how a self-employed professional manages the retention of invoices and tax data under the GDPR (Regulation (EU) 2016/679), the LOPDGDD (Spain's Organic Law 3/2018), the Spanish Commercial Code, the Spanish General Tax Act and the Spanish Invoicing Regulation (Royal Decree 1619/2012), with emphasis on what the average freelancer actually needs: what time limits apply, how to decide whether or not to ask the client for their tax ID, where to keep copies and what to do when the activity ceases.

The three time limits that coexist over the same invoice

An invoice issued by a self-employed professional is governed simultaneously by at least three regulatory frameworks with different periods. It is worth being clear about them so as neither to fall short nor to keep too much:

Rule	General period	Exceptions / extensions
Spanish Commercial Code (Art. 30)	Six years from the last entry, for books, correspondence, documentation and supporting records.	General or special provisions imposing longer periods.
Spanish General Tax Act	Four-year limitation period for tax debts.	Negative tax bases or carry-forward tax credits: up to ten years.
Spanish Civil Code (Art. 1964)	Five years for personal actions with no specific period.	Specific actions (defects, professional liability) with their own periods.
Sectoral rules	Variable.	Construction (ten-year liability under Art. 17 LOE), anti-money laundering (ten years), etc.

The practical rule for the average freelancer is to retain billing for at least six years from the last accounting entry, which is the period under the Spanish Commercial Code. That also covers the general tax limitation period and the ordinary civil one. For sectors with longer specific periods (construction with decennial liability, professionals obliged under the Spanish Anti-Money Laundering Law (Law 10/2010)), the period is adjusted to the specific one.

Client tax ID: when it is mandatory and when it is disproportionate

The Spanish Invoicing Regulation (Royal Decree 1619/2012) distinguishes two scenarios:

Full invoice: where the recipient is a trader or professional, or it is an intra-Community transaction, the recipient's tax ID must be included. This is the normal situation in B2B and in professional services that the client wishes to deduct.
Simplified invoice (formerly a "ticket"): for low-value B2C transactions, the client's tax ID is not required. The Regulation itself allows a simplified invoice without identifying the recipient for operations below the established thresholds. If the client asks for it to deduct the expense, it is upgraded to a simplified invoice with full details and the client is then identified.

The minimisation principle of Art. 5(1)(c) GDPR requires not to collect data that is not necessary for the purpose. A self-employed professional selling to the final consumer should not turn it into routine to ask for the DNI of every client where it is not required to deduct the expense. Asking for the tax ID "just in case" or "for tracking" is data processing without sufficient legal basis.

Where to keep invoices: professional cloud or encrypted local storage

Digital retention of invoices is typically done in two ways:

Invoicing software with built-in storage (Holded, Quaderno, Factura Directa, Anfix, Sage, ContaSimple, etc.). The provider acts as processor (Art. 28 GDPR) and the corresponding contract must be signed, normally included in its general terms. Check that it covers sub-processors, international transfers and return of the data when the service ends.
Cloud storage (Google Workspace, OneDrive for Business, Dropbox Business, iCloud for professionals). Same regime: the provider is a processor, the Art. 28 GDPR contract must be signed, and the free or personal versions are not suitable because they do not include that contract.

What is not professionally suitable:

Personal Drive, Dropbox Basic, personal iCloud shared with the family.
Email as the main archive (invoices mixed with personal emails, without classification, without strengthened security).
An unencrypted USB stick that travels between the laptop and the gestoría's computer.
A desktop folder with no backup.

The reasonable method: professional invoicing software with automatic backup + encrypted backup to a professional cloud + periodic delivery to the gestoría through a secure channel. Invoices should never live in a single place: if that place fails, the business is lost.

The gestoría as processor: the Art. 28 GDPR contract

Almost every autónomo in Spain works with a gestoría (Spanish accountancy/advisory firm) that receives their invoices to file VAT, personal income tax and annual summaries. The gestoría acts as processor over the data of the freelancer and their clients. The relationship requires an Art. 28 GDPR contract with the minimum content of Art. 28(3):

Subject matter and duration, nature and purpose, types of data and categories of data subjects.
Obligations of the controller (the autónomo) and of the processor (the gestoría).
Confidentiality of the gestoría's staff.
Security measures: encryption in transit, access controls, backups.
Sub-processor regime: if the gestoría uses third-party software, that subcontracting must be authorised.
Assistance with data subject rights and breach notification.
Return at termination of the relationship: the gestoría returns the documentation to the autónomo and does not simply destroy it (Art. 28(3)(g) GDPR). This is especially important when the freelancer changes gestoría.

Most reputable gestorías offer this contract as an annex to their engagement letter. The autónomo must review, sign and file it. If the gestoría does not offer that contract or refuses to sign it, it is worth considering a change of provider.

"The most typical retention period for an autónomo does not come from the GDPR: it comes from the Spanish Commercial Code. Six years from the last entry. What happens is that the documentation carries personal data embedded in it, and that is why it has to be safeguarded with GDPR measures. The invoice is not kept because the GDPR requires it; it is kept because of the Commercial Code, and it is protected by the GDPR."

Mario P. Talamillo · Managing Partner, Certix®

When a client requests erasure of their data

The right to erasure under Art. 17 GDPR is one of the points where there is the greatest confusion in the sector. The practical rule is:

If the client requests erasure and there is a statutory retention obligation (accounting, tax, civil), the freelancer cannot delete the documentation; they must reply explaining the obligation and the period. Once the period has elapsed, erasure is in order.
If the data is in accessory processing (marketing list, phone contacts list, commercial cards with no statutory obligation), erasure must be carried out within the time limit.
The period to respond to an erasure request is one month from receipt, extendable by two further months where the request is complex (Art. 12(3) GDPR), informing the data subject of the extension.
The response must be in writing and kept in the autónomo's archive to evidence compliance.

Cessation of activity: the phase almost nobody plans for

Cessation of activity by the self-employed professional —retirement, change of profession, leaving the regime— does not eliminate retention obligations that are still in force. Accounting and tax documentation remains protected by the periods of the Spanish Commercial Code and the Spanish General Tax Act for several years after the last entry.

The reasonable options for the autónomo who ceases activity are:

Personal custody: organising the archive and keeping it at home with reasonable security measures. Feasible for freelancers with a low volume of documentation.
Custody by the gestoría: many gestorías offer post-cessation document retention as a service. It requires an Art. 28 GDPR contract covering that phase.
Professional document custody service: specialist companies retaining physical and digital archives with technical guarantees. Suitable for freelancers with a high volume or sensitive documentation.

Once all periods have elapsed, secure destruction applies: paper shredding using a shredder of an appropriate security level, or a certified professional service; secure erasure of digital files using tools that overwrite the freed space; and the formal deregistration of any residual professional database.

Invoicing and retention checklist

General retention period of six years from the last entry (Spanish Commercial Code), extendable depending on specific situations.
Client tax ID only where required by the Spanish Invoicing Regulation; not turned into routine.
Professional invoicing software with Art. 28 GDPR contract signed and filed.
Encrypted backup to a professional cloud (not to free personal versions).
Art. 28 GDPR contract with the external gestoría, with return of data at termination.
Documented procedure for handling erasure requests (with or without an outstanding statutory period).
Cessation plan providing for retention during outstanding periods and secure destruction at the end.
Annual review of the archive: which documentation has met its period and may be destroyed, what new documentation comes in.

Frequently asked questions

How long does a self-employed professional have to keep invoices issued and received?

As a general reference, Art. 30 of the Spanish Commercial Code sets six years from the last entry. The Spanish General Tax Act sets general four-year limitation periods, extendable to ten years where negative tax bases or pending tax credits are involved. Art. 1964 of the Civil Code sets five years for ordinary civil claims. Practical rule: retain at least six years from the last entry, adjusted upwards for sectors with specific periods (construction, anti-money laundering).

Does the autónomo have to keep the client's DNI or tax ID on every invoice issued?

The Spanish Invoicing Regulation requires the recipient's tax ID on a full invoice where the recipient is a trader or professional or in intra-Community operations. In ordinary B2C a simplified invoice without a tax ID is enough. Asking for the DNI "just in case" of clients who do not need it breaches the minimisation principle of Art. 5(1)(c) GDPR.

Are cloud copies of invoices lawful for a self-employed professional?

Yes, provided two conditions are met: Art. 28 GDPR contract with the provider (included in the professional versions such as Google Workspace, OneDrive for Business, Dropbox Business) and analysis of international transfers if the servers are outside the EEA. Free or personal versions do not include that contract and are not suitable for professional data.

What happens to the client's data when the autónomo ceases activity or retires?

Cessation does not eliminate retention obligations that are still in force. Accounting and tax documentation must be kept for the periods of the Spanish Commercial Code (six years) and the Spanish General Tax Act (general four-year limitation). Options: personal custody, custody by the gestoría under an Art. 28 GDPR contract covering that phase, or a professional document custody service. Once periods have elapsed, secure destruction.

This content is for informational and educational purposes only and does not constitute legal advice. Applying the regulation to each specific case requires individual analysis. Regional sectoral regulations may extend or modify time limits and requirements.

Do you have orderly document retention for your self-employed activity?

At Certix we assign you a compliance specialist for self-employed professionals. No commercial intermediaries, no generic templates.

Speak to a specialist

Invoicing and retention of tax data for the self-employed: how long and how