July 8, 2026 · Compliance · 5 min read

GoBD for Online Retailers: What Really Matters (and What Doesn't)

The "Principles for the Proper Keeping and Storage of Books, Records, and Documents in Electronic Form and Data Access" – GoBD for short – sounds like a topic for tax advisors. In reality, GoBD affects every online retailer who creates electronic invoices, processes data, and stores documents. The good news: for operational practice, the essentials can be reduced to four points.

Immutability and Audit-Proof Archiving

The core principle of GoBD is the immutability principle. Every invoice, every accounting document, every transaction must be archived so that it cannot be subsequently altered – or any alteration is recognizable and logged.

In practice this means: PDF invoices cannot be overwritten after sending. Changes to already-closed accounting periods are not permitted. Systems must maintain a complete audit trail of all bookings.

Completeness and Timely Recording

Documents must be recorded completely and promptly. Under GoBD, cash register records must be recorded daily; for other bookings, a period of generally 10 days applies. For day-to-day e-commerce operations, this is no problem when invoices are automatically generated upon order completion.

What many overlook: incoming documents – supplier invoices, credit notes, marketplace refund receipts – are also subject to GoBD requirements. They must be archived in readable form and the time of receipt must be traceable.

Retention Periods

Tax-relevant documents must be retained for 10 years (§ 147 AO). This includes all outgoing invoices, accounting documents, and tax records. Commercially relevant documents without tax relevance are subject to a 6-year retention period (§ 257 HGB).

Storage location is irrelevant for GoBD purposes – cloud archiving is permitted as long as immutability and readability are guaranteed.

What Software Must Provide

GoBD-compliant software must ensure three things: first, audit-proof archiving of all documents; second, a complete, traceable audit trail for all booking changes; and third, export of all relevant data in machine-readable format for a potential tax audit.

Colly.io meets all three requirements: invoices are archived with timestamp and hash value, changes are logged and cannot be retroactively deleted, and all booking data can be exported in DATEV-compatible format.