Document retention periods in Turkey depend on the type of record: the Turkish Commercial Code (TTK) requires ledgers, financial statements, commercial correspondence and accounting documents to be kept for ten years, the Tax Procedure Law (VUK) for five, and Social Security Law No. 5510 for ten. In practice the longer period applies, while personal data must be disposed of once its period ends.
Key takeaways
- For ledgers, balance sheets, invoices, accounting records and commercial correspondence, the safe rule is at least 10 years from the end of the calendar year.
- The five-year period in the VUK does not shorten the TTK's ten years; where both laws apply, the longer one wins.
- e-Invoices, e-Archive invoices and e-Ledgers must be kept in their original electronic form; a printout is no substitute.
- An expired record is not automatically "safe to bin": if it holds personal data it must be disposed of under KVKK, and if there is litigation or an audit it must be kept.
- Setting the retention period at folder level, listing expired records and applying a legal hold takes the job out of people's memories.
Why do document retention periods cause companies so much trouble?
The problem is rarely not knowing the law; it is not knowing where the document is. Invoices sit in the accounting package, contracts in email attachments, personnel paperwork on an HR desktop and older years on a file server in the office. When an inspection or claim arrives, it cannot be found or turns up in several versions.
The opposite risk is just as real: holding on to personal data long after its purpose has ended. According to the Personal Data Protection Authority's 2025 Annual Report, 551 of the notices and complaints it received in 2025 concerned failure to erase, destroy or anonymise personal data. Keeping everything for ever is no safe harbour.
The archive itself is also a target. In Sophos research based on its State of Ransomware 2024 data, 94% of organisations hit by ransomware said attackers tried to compromise their backups, and 57% of those attempts succeeded. If a record you must keep for ten years exists in a single copy, one attack puts your retention obligation at risk; see our guide to ransomware-resilient backups.
Which records must be kept, and for how long? (Summary table)
The table below summarises minimum periods for the record types Turkish companies meet most often. Periods reflect legislation in force as of 2026; sector rules may require longer.
| Record type | Legal basis | Minimum period | When does it start? |
|---|---|---|---|
| Commercial ledgers, inventories, opening and interim balance sheets, financial statements, annual activity reports | Turkish Commercial Code No. 6102, Art. 82 | 10 years | End of the calendar year of the last entry or of the document's preparation |
| Commercial letters received and copies of those sent (business email is generally treated as included) | TTK Art. 82 | 10 years | End of the calendar year the letter was received or sent |
| Invoices, delivery notes and other accounting documents | TTK Art. 82 and Tax Procedure Law No. 213, Art. 253 | 10 years (5 under VUK; the longer applies) | End of the calendar year the document arose |
| e-Invoice, e-Archive invoice, e-Ledger | VUK and TTK | 10 years, in original electronic form | End of the calendar year the record relates to |
| Social security premium and service documents, payroll, workplace books and records | Social Security Law No. 5510, Art. 86 | 10 years | From the calendar year following the relevant year |
| Personnel files | Labour Law No. 4857, Art. 75 | No express period in the law; common practice is at least 10 years after employment ends | End of the employment relationship |
| CVs of unsuccessful candidates | Personal Data Protection Law No. 6698, Art. 4 | As long as the purpose requires; set a short period in policy | End of the recruitment process |
Two points are often missed. First, the VUK's five years and the TTK's ten are not alternatives: every company that is a merchant applies ten. Second, because the law sets no period for personnel files, the period is set in company policy with limitation periods for employee claims in mind; agree it with your legal adviser. How employee data may be processed is covered in employee personal data under KVKK.
When does the retention period start and end?
Under the TTK, the ten-year period starts at the end of the calendar year in which the last ledger entry was made or the document arose. An invoice dated 15 March 2026, for example, starts its clock on 31 December 2026 and expires on 31 December 2036. The VUK and Law No. 5510 likewise start the clock from the calendar year following the relevant year, so in practice "document year + 10" works.
When the period ends, the record is not disposed of automatically, and should not be. If a tax inspection, lawsuit or enforcement proceeding is under way, the relevant documents are kept until it closes. Records containing personal data are erased, destroyed or anonymised under the company's data retention and disposal policy; the secondary regulation under KVKK requires periodic disposal at intervals of no more than six months.
How should electronic records be kept?
TTK Art. 82 allows ledgers and documents to be kept on image or data carriers, provided they remain readable and accessible throughout the retention period. There is one exception: opening and interim balance sheets and financial statements cannot be kept as scanned images alone, and the originals must be preserved too. For a record born electronic, the original is electronic: for an e-Archive invoice or e-Invoice, keeping a printout does not meet the obligation and the XML file must be preserved. The same applies to e-Ledger files and their certificates.
Email is a special case. Business correspondence containing contracts, orders and quotes is generally treated as "commercial letters" and kept for ten years, yet an attachment left in a mailbox can vanish when the mailbox is deleted or the employee leaves. How to move attachments into a document archive is explained in saving email attachments to document storage, and how long to keep the mailbox itself in email archiving and data protection.
How do you set up a retention scheme in six steps?
A small or mid-sized company can put these six steps in place within a few weeks:
- Build a record inventory. List the document types each department creates and receives, and note the legal basis and minimum period next to each.
- Choose one place for the archive. Gather records in a single department-based business document management environment.
- Structure folders by year and record type. A layout such as "Finance / 2026 / Purchase invoices" lets you calculate retention at folder level.
- Restrict the right to delete. If everyone who uploads can also delete, your retention period is shorter in practice than on paper; uploading and deleting should be separate permissions.
- Protect versions and allow recovery. A contract that has been overwritten counts as lost for retention purposes; document version control closes that gap.
- Schedule an annual review. At each year end, list expired folders, dispose of those holding personal data with a disposal record, and put a hold on anything subject to litigation or audit.
Firms that keep documents on behalf of clients, such as accountancy practices, will find more detail in accounting firm document management.
How does SmartFiles help you manage retention periods?
SmartFiles business file management, developed by Digital Bridge, moves retention out of people's heads and onto the folder itself. In SmartFiles you can assign a retention period of between 1 and 30 years to a folder; documents whose period has expired are listed for the person responsible but are never deleted automatically.
Take a concrete case. A manufacturer's finance team opens folders for purchase invoices, sales invoices and contracts for each year in its "Finance" storage area and gives them a ten-year retention period. The accounts trainee gets upload rights but not delete rights, and because all eight permissions are managed from a single matrix on one screen, there is no need to duplicate folders. When a dispute arises with a supplier, the organisation's administrator places a legal hold on the relevant contract folder with a stated reason: held documents cannot be sent to the bin, permanently deleted or moved, and automatic clean-up skips them.
The monthly report for each storage area shows how many documents have passed their retention period or will do so within 30 days, and can be downloaded as CSV. The activity history records who did what to which document and when, together with the IP address, and can be downloaded as CSV. Readable documents are scanned for personal data such as Turkish ID numbers, IBANs and card numbers, so you can see which folders on the disposal list contain it.
SmartFiles reads e-Invoice and e-Archive XML files directly, without AI, and puts fields such as invoice number, date, tax number and total into one table; for PDF or scanned invoices, AI does the same job. A file deleted by mistake can be restored from the bin for the period the organisation sets (30 days by default). For details and what the package includes, see the SmartFiles product page.
How does Digital Bridge help with document archive projects?
Digital Bridge has served clients across every province of Türkiye, remotely and on site, from its base in Adana since 2013. On retention projects we first map your record inventory and retention periods with you, then set up storage areas, folder structure and the permission matrix.
The personal data side, including the retention and disposal policy, VERBİS registration and disposal records, is handled through our data protection compliance consultancy. If you want to work with other products in the Smart360 family, SmartFiles uses the same sign-in as SmartMail, and email attachments can be saved straight into the right folder.
Next step: where should you start checking your retention periods?
Start by filling in the table above with your own record types and noting, on each row, where that record lives today. Rows that say "personal laptop" or "email attachment" are your priority. Moving them into a single archive, setting retention at folder level and restricting delete rights closes most of the risk within the first month.
To buy SmartFiles, use the Smart360 purchase page, or review the features first on the SmartFiles product page. If you would like us to look at your current archive with you, book a meeting through our contact page. For a short primer on the data protection law, see KVKK in our glossary; more guides are collected under security and data protection.