Business fax archiving: metadata, retention periods and GDPR purging

Short answer: in 2026, a fax only counts as evidence if you can produce it together with its transmission report, in a readable format, on a verifiable date — sometimes ten years later. Yet most organisations do exactly the opposite: they keep thousands of received pages in a shared mailbox, with no naming convention, no off-site backup, and purge at random whenever the quota blows up. The method comes down to four decisions: set a retention period per document type (rather than "keep everything"), choose a durable format (PDF/A rather than some exotic TIFF or a screenshot), keep the transmission metadata with the document (number dialled, date, time, page count, status), and schedule the purge to stay GDPR-compliant. Allow half a day to scope it out, then a one-off configuration.

The topic is resurfacing for a very concrete reason: the shutdown of the copper network. Arcep is publishing, batch by batch, the decommissioning timetable for Orange's legacy network, and every company unplugging its fax machine discovers at that very moment that it had two archives — the paper tray and the machine's internal log — and that neither will survive the move. Ten years of faxes sometimes live in a 4 MB flash memory that will wipe itself the moment the power is cut.

---

What you are really archiving when you archive a fax

A fax is not a file, it is a triplet. Mistaking it for a simple image explains the majority of unusable archives.

1. The transmitted document. The image of the pages, exactly as it left or exactly as it arrived.
2. The proof of delivery. The transmission report: number dialled, date and time, duration, number of pages sent, result code. In front of a court, this is the item that turns "I sent it" into "here is the trace of the sending".
3. The business context. Which case, which client, which patient, which contract the document relates to. Without that link, the archive exists but cannot be found — which amounts to the same thing.

French case law treats a fax as prima facie written evidence (a commencement de preuve par écrit), corroborated by external elements: acknowledgement of receipt, subsequent action taken, later exchanges. In other words, the value of a fax depends less on its form than on the strength of the body of evidence surrounding it. We set out that reasoning in detail in our article on the legal value of the fax; the practical takeaway here is this: archiving the image without the report means archiving half the evidence.

---

How long should you keep it? The reference table

There is no such thing as a "fax retention period". The duration depends on the document being carried, not on the pipe. The relevant rules are found in the French Commercial Code, Civil Code, Labour Code, Public Health Code and the CNIL's reference frameworks.

Two pitfalls come up time and again.

The first: keeping things "just in case". The GDPR requires storage limitation (article 5(1)(e)). An archive of medical or HR faxes kept for ten years "because you never know" is a compliance failure, not a precaution. The CNIL regularly points this out during audits: a retention period must be justified, documented in the record of processing activities, and actually applied.

The second: confusing current archiving with permanent archiving. A document that is useful day to day stays accessible online. Once its period of usefulness has passed, it moves to intermediate archiving: restricted access, exceptional consultation, scheduled deletion. The two regimes are not stored in the same place and are not backed up in the same way.

---

Which format will last ten years

A native fax often arrives as a Group 3/4 TIFF, black and white, 204 × 196 dots per inch. It is a robust format, but one whose readability depends on tools that are becoming rarer on modern office workstations.

The common-sense rule in 2026:

• Target format: PDF/A (PDF/A-1b or PDF/A-2b). This is ISO 19005, designed precisely for long-term archiving: embedded fonts, no external dependencies, stable rendering twenty years from now.
• Keep the original where possible. If your fax-to-email service delivers a TIFF, keep it alongside the PDF/A. A conversion is an alteration; if the document is challenged, the original carries more weight.
• Never recompress to JPEG. Lossy compression introduces artefacts on text that is three pixels tall. A stamp or a handwritten signature becomes debatable.
• Avoid screenshots. It sounds obvious, and yet case files are full of captures of the preview window, with no metadata and no timestamp.

If you need to digitise old paper faxes before closing down the archive room, a duplex automatic document feeder scanner completely changes the scale of the job: 2,000 pages processed in a day instead of a week. Set it to 300 dpi greyscale rather than pure black and white: faded thermal faxes come out far better, and the subsequent character recognition produces usable results.

What about OCR?

An unindexed fax archive is a dead archive. The text layer added by OCR lets you retrieve a document by company name, case number or product reference. Two precautions: the OCR layer must be added without modifying the image ("text under image" mode), and the error rate on a 204 dpi fax remains high — OCR is there to help you find documents, not to serve as proof.

---

The practical architecture: where to put the files

Three models coexist, from the most fragile to the most solid.

Model 1 — the shared mailbox. This is the default destination for fax-to-email. Simple, immediate, and dangerous beyond two years: quotas, accidental deletion, no fine-grained access control, no automatic purge by document type. Acceptable as an intake buffer, never as an archive.

Model 2 — the disciplined file tree. One folder per year, one sub-folder per month, a strict naming convention:

2026-09-18_1432_+33155667788_quote-lemoine_3p_OK.pdf

Date, time, remote number, subject, page count, status. This naming alone solves 80% of search problems, and it survives any migration. Add a monthly journal.csv file with the same columns: that is your transmission register, exportable and readable without proprietary software.

Model 3 — the EDM or the electronic archiving system. For large volumes and regulated professions, an electronic archiving system compliant with the NF Z42-013 standard (and its international equivalent ISO 14641) delivers what a network folder cannot: a digital fingerprint for every file, a tamper-proof event log, access traceability, certified destruction. It is the only model that lets you tell a judge: "this document has not been altered since it was deposited".

Between the two, many SMEs simply install a two-bay NAS with mirrored disks in a locked room. It is not a certified archiving system, but it is infinitely better than an external drive sitting on a shelf: redundancy, snapshots, per-user permissions, and scheduled backup to a second site.

---

The 3-2-1 rule, applied to faxes

An archive without a backup is not an archive, it is a pile. The accepted rule in the profession remains 3-2-1:

• 3 copies of the data,
• on 2 different media,
• 1 of them off site.

For faxes, that means in practice: the working copy on the server or NAS, one copy on an encrypted external hard drive kept in another building or a safe, and one copy with a hosting provider (your supplier's backup space, or professional cloud storage with client-side encryption).

Three points are often forgotten:

1. Test the restore. A backup that has never been restored has, statistically, a one-in-three chance of being unusable. Once a year, pull five faxes at random from the cold archive and check that they open.
2. Encrypt anything that leaves the building. A fax very often contains personal data, sometimes Article 9 data (health). Media taken off site without encryption is a security incident waiting to happen. Hardware-encrypted drives avoid the whole "password on a sticky note" problem.
3. Remember the UPS. A power cut during an archive write corrupts the volume. An 800 VA UPS for NAS and servers is enough to allow a clean shutdown.

---

From paper to digital: the decommissioning project

When the PSTN is switched off in your area, you inherit two stocks to deal with.

The fax machine's internal log. Before unplugging, print or export the log of the last 200 transmissions. Many models allow an export to a USB stick. This is often the only trace of the last few months' sendings.

The paper tray and the binders. Digitise whatever still has evidential value according to the table above, and destroy the rest. "Destroy" means secure destruction: a P-4 cross-cut shredder is the minimum for documents containing personal data, and the recycling bin is in no way an appropriate measure within the meaning of Article 32 of the GDPR.

For the transition period, bear in mind that moving to an online fax service mechanically solves part of the problem: every send and every receipt generates a dated file and an acknowledgement, stored on the provider's side and retrievable by email. Do check, however, your provider's contractual retention period: it is often 30 to 90 days. Beyond that, archiving is up to you. Our Receiving a fax page explains how email delivery works, and the FAQ covers specific numbering scenarios.

---

Securing access without blocking work

The fax archive is a concentrate of sensitive data: it is where you find the reports, the contracts, the bank details sent over by a supplier in a hurry. Four measures are enough to make it defensible.

• Permissions per folder, not per server. The accounts department does not need the HR faxes. The principle of least privilege applies to archives just as it does to everything else.
• Access logging. Knowing who opened what, and when. On a professional NAS, it is a checkbox.
• Two-factor authentication for remote access. A physical FIDO2 security key for administrator accounts costs about the price of a lunch and eliminates almost all password-based compromises.
• No rogue local copies. A fax exported to an employee's workstation escapes the purge, the backup and the permissions. It is the most common form of leak.

---

Scheduling the purge: the step nobody takes

Keeping things is a reflex; deleting them is a decision. You take it once and then automate it.

1. Write the policy: a three-column table (document type → retention period → final outcome: deletion or transfer to permanent archives). One page is enough.
2. Enter it in the record of processing activities. The retention period is a mandatory entry under Article 30 of the GDPR.
3. Automate it. A monthly scheduled task that moves folders reaching their expiry date into a review bin, then deletes them after 30 days, avoids both oversights and accidents.
4. Record the destruction. A simple purges.csv log with the date, the scope and the volume is enough to demonstrate that the policy is being applied.

A well-kept archive is not measured by the number of files retained, but by how long it takes to find the right one — and by the certainty that the others really are gone.

---

Frequently asked questions

Does a fax received by email have the same value as a paper fax?

Yes, and often more. A file received via fax-to-email retains its transmission metadata, whereas a thermal page fades within two to five years and becomes illegible. The condition is that you can demonstrate the file's integrity since it was received: fingerprint, timestamp, absence of modification.

Do I need to keep the paper after scanning?

For documents with high evidential stakes (signed contracts, items in an ongoing dispute), yes, for as long as the limitation period runs. For routine flows, the digital copy is sufficient provided the scanning meets the fidelity and durability conditions set out in the French order of 22 March 2017 on the digitisation of paper invoices. When in doubt, the prudent rule remains: keep paper for litigation, digital for day-to-day use.

Does my online fax provider archive my documents on my behalf?

Rarely beyond a few weeks, and never with the status of evidential archiving, unless there is an explicit contractual option. Read the retention clause, and assume by default that archiving is your responsibility.

Do I need a qualified timestamp?

For high-stakes contractual flows, a qualified electronic timestamp within the meaning of the eIDAS Regulation provides an enforceable certain date. For routine administrative traffic, the transmission report plus consistent archiving is more than enough.

What should I do with faxes received in error?

They must not be archived. Notify the sender, delete the file, and note the incident in your register if sensitive data was involved. Keeping a document received in error constitutes processing without a legal basis.

---

In summary

• A fax is archived as a triplet: document, transmission report, link to the case file.
• The retention period depends on the document, not the channel: 10 years for accounting, 5 years for routine contracts, 20 years for hospital medical records.
• Target format PDF/A, original retained, never any lossy recompression.
• Strict naming date_time_number_subject_pages_status: that is 80% of the efficiency for €0 of investment.
• 3-2-1 backup, including one encrypted off-site copy, with an annual restore test.
• Scheduled and documented purging: the GDPR also penalises excessive retention.
• Before unplugging the fax machine when the copper network shuts down, export the machine's log: you cannot recover it afterwards.