Financial

Tax advisers: destroying client files and tax returns

23 July 2026 · 10 min read · DeSnipperaar

A tax adviser manages the most sensitive papers of a business or private client. Tax returns, annual accounts, wage data with a BSN, a copy of the identity document from the Wwft investigation and complete tax client files. Part falls under the tax retention obligation, part under the Wwft and part should be kept as briefly as possible. This guide shows, by part, what you keep, when it may go and how to destroy it confidentially.

The short answer runs as follows. You keep tax returns and the tax administration for seven years, and the data from the Wwft client investigation for up to five years after the end of the relationship. Loose copy IDs and working files you keep no longer than necessary. What may go disappears confidentially and with a certificate.

Two frameworks: tax retention and GDPR

At a tax adviser two frameworks run together. The tax retention obligation and the Wwft require you to keep certain documents on purpose, for a fixed period. Alongside this the GDPR applies, which requires not keeping personal data longer than necessary. The retention obligation sets the floor for what you must keep. The GDPR sets the ceiling for what you may not keep too long.

So treat the client file per type of data. A tax return has a different status than a draft, a copy ID or an email with advice. If you make that distinction, you keep exactly what you must and clear out the rest on time. That way you avoid old files lingering for years without any ground remaining for them.

Retention periods by part

The period differs per type of data. The overview below gives the main line. Count the tax period from the end of the financial year and the Wwft period from the end of the business relationship.

Part	Starting point	Period
Tax returns and tax administration	Tax retention obligation	7 years
Real estate in the file	Extended period	9 years
Wwft client investigation	Wwft, after end of relationship	5 years
Copy ID and BSN	As limited as possible	only what is needed
Advisory correspondence	Purpose-bound	as briefly as possible
Drafts and working files	No retention obligation	clear out at once

Use this as a guideline and not as a substitute for your own assessment per file. When in doubt, consult your professional body or privacy adviser. The tax side is set out in full in the 7-year tax retention obligation, which also covers the extended period for real estate.

Copy ID and BSN: be restrained

A tax client file is full of a citizen service number. It appears on the tax return, on payslips and on a copy of the identity document. The BSN is a sensitive item and a copy ID contains, besides that number, a photo and more than you usually need. So keep only what the client investigation and the return genuinely require and do not hold on to loose copies while there is no longer a ground for them. Whatever you did have on paper you clear out confidentially rather than putting it in the paper bin.

That way you avoid managing a mountain of identity data you did not actually need. How to handle loose BSN entries in older folders and systems is covered in BSN numbers in old administration. Accountancy firms run into the same question, as described in accountants and destroying client files.

The Wwft client investigation and its own period

As a tax adviser you fall under the Wwft and carry out client investigation. You keep its data and documents for up to five years after the end of the business relationship. That period is separate from the tax seven years and can be longer or shorter than it. So keep the Wwft file recognisably apart, so that at the end of the relationship you can count down the right period. What you no longer have to keep by law should not sit in a drawer indefinitely.

After the five years the ground lapses and you clear out the record confidentially. The background and the overlap with the tax period are set out in Wwft: keeping the client investigation for 5 years. Count the period per client and not in one go for the whole archive, so that you destroy nothing too early or too late.

Digital files and data carriers belong with it too

Most work runs digitally these days. Tax returns, scans of passports and complete client files sit in your software package, on laptops and on backups. So an old file is rarely paper alone. When you destroy a client file, the digital side normally belongs with it. A written-off laptop, an old server or an external drive with tax data is not wiped clean at the press of a button. Physical destruction of the data carrier is the surest route.

So treat paper and data carriers together. What may go on paper may usually go digitally as well, and the other way round. That way you avoid clearing out the cabinet while leaving an old drive with the same files behind. Collect the data carriers sealed and have them destroyed confidentially together with the paper.

How to handle it in 6 steps

1. Split the file into tax returns, Wwft investigation, copy ID and working files.
2. Limit copy ID and BSN to what the return and the client investigation require.
3. Count down the Wwft period per client from the end of the relationship.
4. Take the data carriers along and treat digital and paper together.
5. Collect what may go in sealed containers and not in the paper bin.
6. Have it destroyed confidentially with a certificate and record it in your register.

Destroy confidentially with a certificate

Tax client files are destroyed confidentially, because they contain identity, wage and asset data. The paper and any data carriers travel sealed and stay that way until destruction, so the chain is closed. An old work laptop or a backup with tax returns belongs in that same volume.

Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate is your proof towards the GDPR that you acted carefully. Record the destruction in your record of processing. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.

Common mistakes

• Keeping copy IDs indefinitely. Hold on only to what the return and the client investigation require.
• Mixing up the Wwft period and the tax period. They run separately from each other.
• Clearing out only the paper. Data carriers with the same files are otherwise left behind.
• Throwing away unshredded. A tax return with a BSN on the street is a reportable data breach.
• Keeping no proof. Without a certificate you cannot demonstrate the destruction.

Frequently asked questions

How long must a tax adviser keep tax returns and client files?

Tax returns and the tax administration fall under the seven-year retention obligation, counted from the end of the financial year. For real estate data a longer period of nine years applies. Other data you keep no longer than necessary for the advice and its settlement.

May I keep a copy ID and BSN in the client file?

Be restrained here. A copy of the identity document contains a BSN and a photo and is sensitive. Keep only what the client investigation and the return genuinely require and clear out loose copies as soon as the ground lapses.

How long do I keep the Wwft client investigation?

The Wwft requires the client investigation data to be kept for up to five years after the end of the business relationship. After that the ground lapses and you clear out the record confidentially.

How do I destroy tax client files in line with the GDPR?

Confidentially and with a certificate of destruction. Paper and data carriers travel sealed until destruction and you record the action in your record of processing.

Conclusion

A tax adviser works with identity, wage and asset data of every client, between a retention obligation and the GDPR. Keep tax returns and the tax administration for seven years, keep the Wwft investigation for five years after the end of the relationship and be restrained with copy ID and BSN. Treat digital files and data carriers together with the paper. What may go you have destroyed confidentially with a certificate as proof. That way you meet both frameworks and protect your clients' data.

Read also: payroll bureaus: destroying wage data, insurance brokers: destroying client files, credit intermediaries: destroying client files and the GDPR retention periods cheatsheet.

---

Have client files collected? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.