GDPR and e-invoicing: the personal data in an invoice

Key takeaways

An e-invoice contains personal data as soon as the customer is a natural person or a sole trader, and at least the name of a contact in B2B.
Processing rests on performance of the contract and compliance with a legal obligation, not on consent.
Minimisation requires that only the data genuinely useful to the invoice appear on it.
An invoice cannot be erased before the legal retention obligation ends: in Belgium, ten years.
On Peppol, the access points that carry the invoice are processors within the meaning of the GDPR.

An invoice is also a processing of personal data

Switching to e-invoicing does not exempt you from the GDPR. The General Data Protection Regulation, Regulation (EU) 2016/679 applicable since 25 May 2018, applies to any business that processes personal data, and an invoice almost always contains some. The question is therefore not whether the GDPR concerns your invoicing, but how to reconcile it with your tax obligations.

The stake is concrete. You must keep your invoices for several years for the tax authority, while respecting principles that seem to push the other way: keep only what is necessary, for no longer than necessary, and answer your customers' requests about their data. This article explains where the personal data actually sits in an invoice, what basis you process it on, and how legal retention and Peppol transmission fit together with the regulation.

Where the personal data sits in an invoice

It all depends on the nature of the customer and the level of detail. An invoice addressed to a private individual (B2C) is, by construction, a processing of personal data: name, address, sometimes a customer number or order reference. An invoice to a sole trader operating as a natural person is just as much, because their enterprise number is attached to a person, not to a separate structure.

In B2B between companies, the data of the recipient company (company name, VAT number, registered office) is in principle not personal data. But an invoice often mentions the name of a contact, a named email address or an internal reference linked to an employee: those elements do fall under the GDPR. The useful habit is to look at each field and ask whether it designates a person.

The invoice data to review

Identity of a natural-person customer
Name, first name, postal address of a private individual or a sole trader.
Named contact details
Email address or phone number attached to an identified person.
A sole trader's enterprise number
Attached to a natural person, hence personal data.
The name of a B2B contact
The recipient person within a customer company.

The legal basis: no more than the contract and the law

The GDPR requires a processing to rest on a legal basis, listed in Article 6 of the regulation. For an invoice, two bases are enough and combine. Performance of a contract (Article 6(1)(b)) covers issuing and sending the invoice: you invoice because a service was ordered. Compliance with a legal obligation (Article 6(1)(c)) covers everything tax and accounting rules impose, starting with retention of the document.

The practical consequence is important: consent is not the basis of the processing. You do not have to ask a customer's agreement to send them their invoice or to keep it. Consent remains required for other uses of the same data, such as commercial prospecting or a newsletter, but those uses are distinct from invoicing. For the tax framework that underpins this legal obligation, see the legal basis for B2B e-invoicing.

Minimisation: put only the useful on the invoice

The principle of data minimisation (Article 5(1)(c) of the GDPR) requires that processed data be adequate, relevant and limited to what is necessary. Applied to the invoice, this means showing only the information useful to the transaction and the mandatory particulars, without adding superfluous personal data.

In practice, an invoice does not need a customer's date of birth, national register number or private contact details unrelated to the transaction. The expected fields are those the invoicing rules impose: identity of the parties, description, amounts and VAT. Adding more needlessly exposes data and increases your responsibility. For the list of what must appear, see the mandatory particulars of an invoice in Belgium.

Retention and the right to erasure: the apparent tension

This is the most often misunderstood point. The GDPR sets a principle of storage limitation (Article 5(1)(e)): data is kept only for as long as necessary. It also recognises a right to erasure (Article 17), sometimes called the "right to be forgotten". From this springs the mistaken idea that a customer could demand the deletion of their invoice.

Yet the regulation itself provides the articulation. The right to erasure does not apply where processing is necessary to comply with a legal obligation (Article 17(3)(b)). And the "necessary duration" of the storage-limitation principle is precisely what the tax law sets. In Belgium, invoices are kept for ten years. As long as that period runs, you must keep the invoice, and you cannot delete it at the customer's request alone.

Retention prevails while the legal obligation runs; erasure becomes the rule again once the period has expired.
	During the legal period	After the legal period
Retention of the invoice
Erasure possible at the customer's request
Basis of the processing	Legal obligation	No basis left: deletion expected
Right to rectify the data

The same reasoning applies to archiving: e-invoices are kept in conditions that guarantee their readability and integrity for the whole legal period. The detailed rules appear in how long to keep your invoices in Belgium and in our guide to archiving e-invoices.

The customer's rights over their invoice data

The right to erasure is framed, but the other rights remain fully open. A customer can request access to the data you hold on them and rectification of an inaccurate item, for example a misspelled address. Rectification on an invoice already issued is not done by rewriting the original document: it goes through the accounting mechanisms provided, such as a corrective invoice or a credit note, which preserve the audit trail.

You must also be able to explain, if asked, why you hold this data and for how long. That is the purpose of the information due to data subjects, usually through a privacy policy. Keeping a record of processing activities (Article 30 of the GDPR) helps answer these requests without improvising.

Sending an invoice over Peppol does not step outside the GDPR, but it shifts part of the implementation. On the network, the invoice travels from sender to recipient through access points. These providers handle, on your behalf, personal data contained in the invoice: they act as processors within the meaning of Article 28 of the GDPR. That requires a suitable contractual framework and appropriate security measures on their part. To understand how the invoice travels, see understanding the Peppol network in 5 minutes.

Your responsibility, as the issuing business, remains that of the controller: you decide the purposes and you choose a tool and an access point that offer guarantees. Security of processing (Article 32 of the GDPR) requires technical and organisational measures proportionate to the risk, from encryption of exchanges to access control.

2016/679

GDPR regulation

applicable since 25 May 2018

10 years

retention in Belgium

the invoice is not erased before

art. 28

processing

the Peppol access point acts on your behalf

Invoicing compliant with both the GDPR and Peppol

YouInv generates, keeps and transmits your e-invoices in a framework designed for compliance, with no technical handling on your part.

Create an account See pricing

What this changes for your business

The GDPR does not complicate invoicing: it frames it. The two habits to keep are minimisation, to put only the useful on the invoice, and controlled retention, to keep the document for the legal period without destroying it too early or holding it indefinitely. Customers' rights are exercised within these limits, and Peppol transmission is handled by choosing a serious provider.

The criterion for choosing the tool meets that of Peppol compliance: your software must not only produce a valid structured invoice, but also keep the data securely and frame the processing relationship. That is where GDPR compliance is decided, far more than in a tick box.