Cloud Backup for Accountants and Bookkeepers: Retention Periods and Security

As an accountant or bookkeeper, you work with your clients' most sensitive data: annual accounts, payslips, tax returns, audit files and customer due diligence under the Wwft (the Dutch anti-money laundering act). A crashed server or a ransomware incident doesn't just mean lost productivity; it's an immediate compliance risk. In this article, you'll learn how to set up cloud backup for an accounting or bookkeeping practice, which retention periods actually apply, and where many firms unintentionally go wrong.

Why backup in accountancy is different

In other SME sectors, data loss mainly costs revenue. An accounting firm that loses data mainly loses trust, and on top of that runs straight into legal obligations. You must be able to produce your clients' records, going back years, for the Dutch Tax and Customs Administration (Belastingdienst) as well as for the supervisory bodies BFT (Bureau Financieel Toezicht) or the AFM (the Dutch Authority for the Financial Markets). If you can't reproduce that data, you're empty-handed.

What's more, your systems hold three types of data side by side. The first is your clients' records: bookkeeping in Twinfield, Exact Online, AFAS, SnelStart or Visma AccountView. The second is your own practice administration and your Wwft customer due diligence. The third is your audit files, which fall under the Wta and the Bta (the Dutch Audit Firms Supervision Act and its implementing decree). All three have their own retention periods and their own security requirements.

Retention periods at a glance

In accountancy, three regimes overlap. If you don't keep them apart, you either throw data away too soon or build archives that are needlessly large.

• Tax retention obligation: 7 years. The basic rule for all business records: keep them for 7 years from the moment they cease to be current. So a 4-year lease contract is kept for its 4-year term plus 7 years afterwards. From 1 January 2026, most records from 2018 can in principle be disposed of.
• Tax retention obligation for real estate: 10 years. For real estate (and the VAT on it), the period is 10 years instead of 7.
• Wwft retention obligation: 5 years. Customer due diligence and reported unusual transactions are kept for 5 years after the transaction or after the end of the business relationship. This is a separate obligation for accountants and tax advisers, on top of the tax rules.
• Wta/Bta retention obligation for audit files: 7 years. An audit firm must keep a closed audit file for at least 7 years. That file includes the engagement letter, correspondence, the audit plan and a record of the nature and scope of the work performed.

They look similar, but they're not the same. The RB (Register Belastingadviseurs, the Dutch association of tax advisers) has previously pointed out that the discrepancy between 5 and 7 years causes confusion in practice. The practical advice: internally, let the longest period be the one that counts, and only destroy data once the retention obligation under every regime has expired. Your backup retention should follow suit.

What good cloud backup for your practice covers

Cloud backup for accountants is more than just an external copy of your server. You have four layers to cover:

1. On-premises servers and NAS. If you still have a local file server or NAS with working files, annual plans or PDF archives, it needs an automated backup to a second location.
2. SaaS accounting packages. The data in Twinfield, Exact Online and AFAS sits on the vendor's servers. The vendor makes its own backups for disaster recovery, but that isn't a customer backup: if an employee accidentally deletes journal entries or a client wipes their own data, the vendor isn't obliged to restore it to a specific point in time. Check the small print of your package and consider an export backup.
3. Microsoft 365 and Google Workspace. Email, calendars, OneDrive/SharePoint or Google Drive and Teams chats live in the cloud, but Microsoft and Google explicitly refer to the shared responsibility model: you are responsible for your own data. A separate backup layer (Barracuda Cloud-to-Cloud, Druva, Keepit, Veeam Data Cloud, NinjaOne, MSP360) has become a basic requirement for accountants.
4. Workstations and laptops. Stray Excel files, Word notes and downloaded PDFs that only exist on a laptop can't be recovered after theft or hardware failure without endpoint backup.

For more depth on setting up a modern backup architecture, see our complete backup strategy for SMEs and our article on Backup as a Service for SMEs.

The 3-2-1 rule applied to an accounting firm

The classic 3-2-1 rule remains the foundation: 3 copies of your data, on 2 different types of storage, with 1 copy offsite. For accountancy, the extended 3-2-1-1-0 version is more relevant: the extra "1" is an immutable or offline copy, and the "0" stands for zero errors after verification.

In practice, for your firm:

• Copy 1: your production data (server, SaaS, cloud workplace).
• Copy 2: a local backup on a NAS or separate disk for fast restores.
• Copy 3: an offsite cloud backup in an EU data centre.
• Copy 4 (immutable): a write-once copy, for example via S3 Object Lock, that can't be changed or deleted within the configured retention period. Not even by someone with admin rights.

That fourth copy isn't a luxury. Ransomware gangs deliberately target backup systems: if they can encrypt or delete your backups, their negotiating position is much stronger. An immutable copy breaks that game.

Retention periods in your backup: retention vs archive

A classic mistake is trying to meet your retention obligations with backup retention alone. It's possible, but expensive and impractical. Backup exists to reconstruct what went missing yesterday or last week. For retention periods of 7 or 10 years, an archive is a better fit: exported annual files in a structured folder hierarchy, with readable file names and version information, on write-once storage.

So combine two tracks:

• Backup retention for operational restores: for example 4 weeks of dailies and 12 months of monthlies. This covers "oops, wrong journal entry" or "a client wiped their own financial year".
• Archive retention for the statutory periods: an annual export of every closed audit or compilation file to the archive, retained for 7 years (Wta/Bta, tax) or 10 years (real estate). This covers "the tax inspector is calling about the 2020 return".

That way you're not paying year after year to hold on to daily snapshots you'll never request again.

GDPR, data residency and the CLOUD Act

An accounting firm's client data is by definition personal data, or at the very least confidential. The GDPR sets requirements for it, and the US CLOUD Act makes it even more sensitive. Under the CLOUD Act, US authorities can demand access to data stored by an American company, even if that data physically sits in Europe.

For an accounting firm, that means in practice: preferably choose a backup provider with data centres in the EU and a European parent company, or agree contractually that your data will not leave the EU. Encryption with keys you manage yourself (BYOK, bring your own key) helps too. A good provider will also sign a data processing agreement that fits your duty of confidentiality as an accountant.

The broader context of practical GDPR compliance for SMEs helps you align your backup contract with your other data processing agreements.

What does cloud backup cost an accounting firm?

Prices vary widely by provider and scope; the figures below are a guide for Dutch SMEs, not a quote.

• SaaS backup for Microsoft 365 or Google Workspace: often around €3 to €6 per user per month for email, drive, calendar and Teams chats, with longer retention at extra cost.
• Server backup to the cloud: roughly €0.01 to €0.03 per GB per month for raw storage, plus an agent or licence fee per server.
• Immutable offsite tier: an extra €5 to €20 per month for small volumes; scales linearly with volume.
• Managed backup service from an MSP: often included in a managed IT package or offered as a separate service for €100 to €300 per month for a small firm, including monitoring, daily checks and test restores.

What you save when things go wrong outweighs the monthly fee. According to various sources, ransomware incidents at Dutch SMEs cost hundreds of thousands of euros per case, and that's before the reputational damage with clients who saw confidential data leak.

The restore is the test, not the backup

A backup you never restore is an assumption, not a certainty. Schedule a test restore at least once a quarter. Choose a different scenario each time: a single file today, a complete mailbox next time, a full server on new hardware three months from now. Document how long it took, who did it and what could be improved. That's how you build a business continuity plan that goes beyond a promise on paper.

A service level agreement for IT services therefore shouldn't just include an uptime percentage, but also a concrete RTO (how quickly you're back online) and RPO (the maximum amount of data you can lose). For an accounting firm in peak season, such as tax filing season or year-end close, an RTO of 4 hours and an RPO of 1 hour is a realistic minimum.

Frequently asked questions about cloud backup for accountants

How long do I need to keep a file as an accountant? For most records, 7 years (tax). For real estate, 10 years. For Wwft customer due diligence, 5 years after the end of the relationship. For audit files, 7 years after closure (Wta/Bta). Internally, apply the longest period that applies.

Doesn't Twinfield, Exact or AFAS already take care of my backup? The vendor makes backups for its own business continuity, not for your point-in-time recovery at individual client level. If an employee accidentally deletes journal entries or a client loses their data, you're often still left empty-handed without a separate export. A separate backup layer or periodic export is a sensible addition.

Is a Microsoft 365 backup really necessary? Microsoft works on a shared responsibility model: the infrastructure is their problem, your data remains your problem. The recycle bin and retention policies cover short periods. For the retention periods that apply in accountancy, and for ransomware scenarios, a third-party service that makes a separate daily copy is effectively a basic requirement.

What does immutable backup mean in practice? Immutable means a backup file can't be changed or deleted within a set period, not even with admin rights. Technically, it's often implemented via S3 Object Lock or similar object storage features. In ransomware scenarios, this is the only layer that is guaranteed to survive.

Where does my backup data need to be stored under the GDPR? The GDPR doesn't require storage in the Netherlands or the EU, but if data is stored outside the EU you must put additional safeguards in place. For personal data and accountancy data, the simplest route is a provider with EU data centres, an EU parent company and a watertight data processing agreement. That also rules out the CLOUD Act risks associated with US providers.

Can I combine backup with my existing IT management? Yes, and that's usually advisable. A managed IT partner that manages your workstations, email and backup can act faster in an incident than three separate suppliers pointing at each other.

Conclusion

Cloud backup for an accounting or bookkeeping practice comes down to three things: understanding which retention periods run in parallel (7 years for tax, 10 years for real estate, 5 years under the Wwft, 7 years for Wta/Bta audit files), setting up a 3-2-1-1-0 architecture with an immutable offsite copy, and choosing an EU provider with a watertight data processing agreement. And don't forget SaaS: Microsoft 365, Google Workspace and your accounting package are not their own backup. Test your restores routinely, because a backup that has never been restored is an assumption.

TRON Group sets up cloud backup and business continuity for accounting and bookkeeping firms across the Netherlands: from SaaS backup for Microsoft 365 to immutable offsite storage in EU data centres, with data processing agreements that fit your duty of confidentiality. Want to know whether your current solution would withstand a real incident, and a BFT inspection? Call us on +31 85 303 5869 or request a no-obligation backup check. We're happy to think it through with you, without a sales pitch.