Invoices and contracts booked in December 2021 hit their five-year tax retention deadline on 31 December 2026, and holding the personal data in them past that date is its own GDPR breach.

KSeF keeping a structured invoice for ten years does not excuse the business from its own duty: once the five-year tax retention window closes, invoices, contracts and files that name a sole trader, contractor or private client can no longer be kept without a legal basis under GDPR's storage-limitation principle. Most firms have never run this check and are sitting on years of documents nobody has cleared.