How long form responses stay: keeping and deleting

A landscaping business in Sursee opens the response sheet of its quote request form. Right at the bottom, on row four, sits an enquiry from March two years ago: name, address, phone number, the size of the plot, one sentence about a slope that would need shoring up. The enquiry was answered at the time. No job came of it.

The row is still there because nobody had a reason to delete it — and because nobody had a reason to keep it. That is the starting point: the question does not raise itself, and once it is raised, three forces pull in different directions.

The first force: the purpose ends

The Federal Act on Data Protection puts the principle in a single sentence. Art. 6 para. 4 FADP: personal data is destroyed or anonymised as soon as it is no longer required for the purpose of the processing.

The sentence contains no period. It contains a trigger, and the trigger hangs on the purpose. Which purpose that is follows from Art. 6 para. 3 FADP: personal data may only be collected for a specific purpose that is evident to the data subject. So the purpose is already fixed before the first response arrives — it is whatever the form promised.

That makes the question answerable case by case:

• The enquiry that was answered. The purpose was to reply to an enquiry. The reply is written, the quote is out, the matter is closed. From that moment, the original purpose no longer carries the row.
• The registration for an event. The course took place, the participants were in the room. The attendance list has done its job once the event is over and settled.
• The application from someone who was not hired. Here there is even a figure. The Federal Data Protection and Information Commissioner (FDPIC) writes in his FAQ that an employer may keep application data for up to three months after notifying the rejection, in order to be able to defend a claim of discriminatory refusal to hire, citing Art. 8 para. 2 in conjunction with Art. 5 para. 2 of the Gender Equality Act. He considers an extension of a few weeks possible where a statement of claim reaches the employer late. That applications sit in a narrower frame at all follows from Art. 328b CO: an employer may process data about employees only insofar as it concerns their suitability for the employment relationship or is necessary to perform the employment contract.

What stands out in all three is that the trigger is an event rather than a date: the reply sent, the event held, the rejection communicated. That is what a deletion rule can later be pinned to.

The second force: periods that require keeping

Against the principle in the FADP sits a set of provisions that expressly order the opposite. The best known is in the Code of Obligations.

Art. 958f para. 1 CO: the books of account and the accounting vouchers, together with the annual report and the audit report, must be retained for ten years; the retention period begins on expiry of the financial year.

Two details in that sentence are routinely read past. First, the period does not start on the date of the document but on expiry of the financial year — a February invoice is therefore covered for roughly eleven years. Second, the provision covers books of account and accounting vouchers, not “all documents”. What an accounting voucher is follows from Art. 957a para. 3 CO: any written records on paper or in electronic or comparable form that are necessary to verify the business transaction or the circumstances behind an accounting entry.

This is where it is decided whether a form response is caught at all. An unanswered quote request that never became an entry is not an accounting voucher. A registration that led to an invoice, and that the invoice rests on, may be one. The same spreadsheet may therefore hold rows in both categories — which is why “we keep form data for ten years” is as imprecise as “we delete it after the event”.

Who is subject to the duty to keep accounts is set out in Art. 957 CO: sole proprietorships and partnerships with at least CHF 500,000 in sales revenue in the last financial year, and legal entities. Below that, and for associations and foundations that need not be entered in the commercial register, Art. 957 para. 2 CO requires accounts only of income, expenditure and assets. For an association running a registration form, that distinction matters.

Two further periods run alongside:

Provision	What it orders
Art. 70 para. 2 VAT Act	Books of account, vouchers, business papers and other records until the absolute limitation of the tax claim; Art. 958f CO is reserved
Art. 42 para. 6 VAT Act	That absolute limitation occurs in any event ten years after the end of the tax period in which the tax claim arose
Art. 70 para. 3 VAT Act	20 years for documents relating to input tax deduction on subsequent qualification and to own use of immovable property
Art. 126 para. 3 DFTA	Ten years for books of account, statements and other vouchers, for self-employed persons and legal entities

Beside the retention duties sits limitation, which is no order to keep anything but can have the same effect: Art. 127 CO sets ten years for all claims for which federal civil law provides nothing else; Art. 128 CO names five years for, among others, craft work, the retail sale of goods and claims arising from an employment relationship; Art. 128a CO provides three years from knowledge for damages following personal injury in breach of contract, and in any event twenty years from the harmful conduct. The FDPIC draws the same line for the personnel file, deriving ten years from Art. 330a in conjunction with Art. 127 CO for the data needed to issue a reference, and five years from Art. 322 in conjunction with Art. 128 CO for working hours, sickness absences and holidays.

What happens when both forces point at the same row

The case is more common than it sounds: someone asks for their data to be deleted, and the same data sits under a retention duty.

The FADP sets out the claim in Art. 32 para. 2 let. c: a claimant may in particular request that personal data be deleted or destroyed. But the claim presupposes an unlawful breach of personality, and Art. 31 para. 1 FADP states that a breach of personality is unlawful unless it is justified by the data subject’s consent, by an overriding private or public interest, or by law. A statutory retention duty is a justification by law.

In practice the two provisions do not contradict each other; they concern different data. A quote request that never became an accounting entry falls under no retention duty. The invoice that grew out of the same enquiry does. How far one can be separated from the other is a matter for the individual case — and not one that can be read off the statutory text.

It is worth noting that the FADP names a maximum age in exactly one place. Art. 31 para. 2 let. c FADP permits the processing of data for a credit check under several conditions, among them no. 3: the data is not older than ten years. That is no general rule for form data — but it shows that the act names a figure when it means to name one.

The third force: deleting is rarely one click

The third difficulty is not a legal one. A form response almost never exists in only one place.

• The notification email. Most form services send an email when a new response arrives, and in many configurations the full content is in it. The row from the spreadsheet is therefore also in the mailbox — and there in the archive, in the sent folder of the forward, and in the offline copy on the laptop.
• The export. Someone downloaded a CSV file for the annual planning. It sits in the downloads folder, perhaps on a shared drive, perhaps as an attachment to a forwarded message.
• The backup. Backups do their job by preserving an earlier state. A deletion today does not reach back into last month’s backup. The usual answer is not to search the backup but to let it expire after a set period.
• The second system. The webhook into the accounting package, the contact copied into the newsletter tool, the entry in the calendar. Somebody set each of those connections up once, and each produces a copy with a life of its own.
• The printout. The sheet that lay on the table at the event.

None of these copies is a mistake; each had a reason. The point is a different one: a deletion rule that knows only the form service describes part of the picture.

What a deletion rule looks like once it is written down

“We delete data as soon as we no longer need it” is an accurate restatement of the statute and not a rule. It becomes one when four things are added, because only then can anyone tell whether it was followed.

The item	What is missing when it is missing
Which category	Quote requests, course registrations, applications and accounting vouchers sit in the same spreadsheet and follow different rules
How long	A period someone can count — not “until no longer needed”
Counted from which event	Arrival, reply, the event taking place, the rejection, the end of the financial year: four different starting points
Who or what deletes	A person with an entry in the calendar, or a setting in the system that does it without a reminder

The FDPIC states the first point expressly for the personnel file: the FADP itself provides no retention period but sets the general principles, and the retention period is to be determined separately for each category of data. That split by category is the part software cannot take over, because only the business knows why it collected which field.

The fourth column, by contrast, is almost always a technical question. A rule that depends on a calendar entry rarely survives the departure of the person who has the entry. A rule stored in the form itself keeps running.

Where the answer stays open

Three points cannot be answered from the statutory texts, and it would be dishonest to smooth them over.

Whether a particular form response is an accounting voucher within the meaning of Art. 957a para. 3 CO depends on whether it is necessary to verify an accounting entry. That is an assessment of the individual transaction.

How long after an answered enquiry a business still has an interest of its own in the row — because of a possible warranty claim, say, or a dispute on the horizon — is a weighing exercise under Art. 31 FADP, not a period.

And individual sectors have additional provisions. The FDPIC himself points to sector-specific reporting, disclosure and information duties, for instance under the Anti-Money Laundering Act or the Banking Act, from which further retention periods can follow. In health care, cantonal documentation duties come on top. Anyone working in such a field will not find the governing rule in the FADP.

What of this hangs on the form

Back to row four. It can be assessed without anyone taking legal advice: what was asked, is that finished, did an accounting entry hang on it, and where does the row sit besides this spreadsheet. Four questions that also face private individuals who set up a form for an event or a group order and have left the responses sitting in a spreadsheet ever since.

What software can contribute is the fourth column of the table above. In the online forms app we are building, a retention period and an automatic deletion rule will be set per form, so that deleting does not hang on someone remembering; responses are encrypted in the browser and stored in Switzerland. Which category a form collects, and how long it sensibly stays, remains the business’s own decision — software changes nothing about that.