Dutch accountants advising SMB clients on receipt digitization sit at the intersection of two regulatory frameworks. The Belastingdienst sets retention requirements under the AWR. GDPR sets data-protection requirements for the personal data those receipts contain. Most SMBs have not designed their receipt workflow to satisfy either framework in full.
This article covers what each framework requires, where SMB receipt workflows typically fall short, and what an accountant should verify before recommending a digitization tool.
Belastingdienst requirements for digital receipts
Three retention requirements apply to digitised receipt records under Dutch tax law.
Seven-year retention from close of financial year
Artikel 52 Algemene wet inzake rijksbelastingen (AWR) requires businesses subject to Dutch taxation to retain financial records for at least 7 years. The clock starts at the end of the financial year in which the transaction occurred, not the transaction date. A receipt dated 3 March 2024 in a calendar-year business must be retained until at least 1 January 2032.
Legible and accessible on request
Retained records must be legible and accessible to the Belastingdienst on request for the duration of the retention period. A receipt stored as a low-resolution JPEG with no metadata — in a folder the accountant cannot access — does not satisfy this requirement. The Belastingdienst can request records during an audit without advance notice; the ability to retrieve specific transactions quickly is the operative test.
Digital originals are acceptable — with conditions
The Belastingdienst accepts digital records in place of paper originals provided the digitised record faithfully represents the original document, is stored in a retrievable format throughout the retention period, and its integrity can be demonstrated. A scan saved as a JPEG in a personal cloud folder without metadata or an audit trail of accesses does not fully satisfy the integrity condition. A structured record with a capture timestamp, original file hash, and immutable storage is more defensible.
GDPR considerations for receipt data
GDPR applies because business receipts contain personal data. Three categories are relevant for Dutch SMBs.
Employee expense data
When an SMB employee submits a receipt for an expense claim, the receipt typically includes the employee's name, the transaction date, and the amount spent. This is personal data under GDPR Art. 4(1). The receipt management tool processing that data is a data processor under Art. 28 and must operate under a signed DPA.
Supplier receipt data
A supplier invoice includes at minimum a company name, address, and VAT number. Where the invoice is from a sole trader or freelancer, it may include a personal name and personal address. GDPR applies. The 7-year retention obligation under Dutch tax law provides the Art. 6(1)(c) legal basis — processing is necessary to comply with a legal obligation — but the data must still be stored with appropriate access controls and under a compliant processor relationship.
Data residency expectations
Dutch SMBs — and by extension their accountants advising on tooling — face an informal expectation from clients, insurers, and the Autoriteit Persoonsgegevens that personal data is processed within the EU. A receipt management tool that stores data outside the EU without documented SCCs creates a compliance gap that falls on the controller (the SMB), not the accountant — but the accountant who recommended the tool without checking will be held accountable by the client.
The two frameworks do not conflict in their core requirements. The Belastingdienst 7-year retention obligation is explicitly carved out by GDPR Art. 17(3)(b), which permits retention where required by Union or Member State law. The GDPR obligation is to protect the data during that 7-year period, not to reduce it. An accountant advising on receipt digitization should frame this clearly to clients: GDPR does not shorten your retention obligation; it sets conditions for how you store the records during it.
Receipt digitization and Exact Online
Most Dutch SMB accountants work in Exact Online. Their clients' receipts need to become Exact Online journal entries — matched to transactions, coded to account and VAT codes, and posted to the correct division. The question for a receipt digitization tool is not only whether it stores receipts compliantly, but whether it carries structured metadata through to the journal entry.
A receipt captured as a JPEG and emailed to the accountant does not satisfy this. The accountant reads the VAT amount, keys the journal entry manually, and attaches the image. There is no structured audit trail between the source document and the ledger entry. If the Belastingdienst queries a specific transaction, the match between receipt and journal entry is a matter of the accountant's memory, not a system record.
A receipt digitization workflow designed for Exact Online should capture structured metadata — date, amount, VAT amount, VAT code, supplier, cost-centre — at submission, and deliver that metadata to Exact Online as a coded journal entry, not as an image. The receipt image is the source document; the structured record is what goes into the ledger.
What to verify when recommending a digitization tool
Seven questions to ask before recommending a receipt digitization tool to an SMB client.
Confirm the tool captures structured metadata — date, amount, currency, VAT amount, supplier name, cost-centre — at submission, not just a raw image
Verify the vendor provides a signed DPA before the first upload, naming all sub-processors and their locations
Confirm EU data residency for account records, or document the SCC basis for any non-EU sub-processors
Set a documented 7-year retention period tied to the financial year close, not the transaction date
Confirm the tool can produce a retrievable, legible record on Belastingdienst request — with a metadata trail, not just a folder of images
Verify role-based access controls: finance staff see receipts relevant to their role, not a company-wide shared folder
Confirm the export path to Exact Online or the relevant bookkeeping platform carries structured metadata through to journal entries
Rexa for Dutch accountants
Rexa is designed as a GDPR-first receipt management tool with EU data residency and a planned Exact Online integration. Account data is stored in the EU in Postgres with AES-256 encryption at rest and TLS in transit. A signed DPA covering all sub-processors is available before onboarding.
The Exact Online integration — OAuth token exchange, division discovery, and structured journal entry creation — is on the product roadmap. The current prototype accepts receipt submissions and matches them to card transactions; the structured posting step to Exact Online is not yet live.
If you are a Dutch accountant evaluating receipt digitization tooling for clients who use Exact Online and have GDPR compliance requirements, join the waitlist. We will notify you when access opens and when the Exact Online integration ships.
Related
Rexa is in pre-launch. If you are a Dutch accountant evaluating GDPR-compliant receipt digitization for SMB clients using Exact Online, join the waitlist for early access.
Join the Rexa waitlist