GDPR Data Deletion Policy: How Companies Systematically Comply with Deletion Deadlines

(personnel file, payroll)

What is a data deletion policy and why is it important?

With a data deletion policy, companies precisely regulate who is to delete which data (customer data, employee data, etc.), when, where the data is stored, and how the deletion must take place. This is particularly important to avoid errors and corresponding consequences under the General Data Protection Regulation (GDPR).

The GDPR Data Deletion Policy – when must data be deleted?

In principle, Art. 17 GDPR regulates the deletion of data, especially personal data. Companies must delete personal data if the purpose for which it was previously collected or processed no longer requires its retention, or if the data subject requests its deletion.

In this respect, the EU-DSGVO the permitted duration for data storage directly to the purpose of data processing.

This Principle of Purpose Limitation forms a fundamental cornerstone of European data protection law. In principle, companies may only collect and process personal data for previously precisely defined, clear, and legitimate purposes. As for data processing, it must also be compatible with the original purpose.

From this principle of purpose limitation, it follows that personal data must be deleted precisely when they are no longer needed for the original purposes of data collection and processing. The topic of a deletion concept is therefore a central pillar in data protection. For this reason, numerous companies have now recognized that a deletion concept according to GDPR and the associated correct handling of data strengthens the trust of customers and partners. Proliance offers GDPR consulting, to address precisely such questions.

Technical Challenges of a Deletion Concept

What sounds so simple in theory often presents a problem in practice. Many companies process a large number of individual data records and regularly secure them via backups. In addition, data is often passed on to third parties by arrangement and with consent, or stored in different systems or various tables. These shared data must then be deleted, as must the data in all tables and storage locations.

The biggest challenge is to reconcile data security and deletion periods:

• Storage: Personal data may only be stored for as long as necessary for the original purpose.
• Security: At the same time, companies must take appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of their systems and data (Art. 32(1)(b) GDPR). Depending on the risk, this also includes data backups and recovery concepts.
• Deletion: Deletion must be reliably possible in the production system; for backups, selective deletion of individual data records is often only of limited practicality and should be considered in the deletion concept with clear rules.

We would be happy to advise you on how to set up a GDPR-compliant system so that you and your company are on the safe side in terms of data protection law.

Is data protection eating up your time?
We'll take care of that for you!

The technical challenges of the GDPR can be overwhelming. With an external data protection officer from Proliance, you receive professional support to implement your data protection requirements efficiently and in a legally compliant manner.

To the External Data Protection Officer

The Deletion Concept: Elegantly Resolving the GDPR Contradiction

To resolve the contradiction between the obligation to delete data and the obligation to secure data, a stringently documented and elaborated deletion concept within the framework of the GDPR is indispensable.

The deletion concept meticulously documents, among other things, the respective purpose as the basis for data collection and processing. The purpose should be described as precisely as possible. For example, if customer data is collected, the general purpose is contract execution. In the deletion concept, the purpose should be defined much more precisely, because the corresponding data must be deleted upon termination of the contractual relationship or after the purpose has been achieved.

This also applies to employee data: Upon termination of employment, data must be deleted, unless retention or evidentiary reasons prevent this. If the purpose of data processing is appropriately defined as the assertion and defense of legal claims arising from the employment relationship, data storage can extend far beyond the duration of the employment contract.

Tip: In the magazine, you can find out more about the question of which employee data must be deleted upon termination.

This can also be applied to other contractual relationships of the company. For instance, if the purpose of data collection in a customer relationship is merely described as the processing of a single transaction, data storage would likely only be legitimate for a short period. Here too, one should consider the handling of further claims arising from the contractual relationship if longer storage is desired.

A well-founded deletion concept cannot solve the technical difficulties involved in deleting individual data records. However, it provides a well-reasoned basis for arguing that data may need to be stored longer in individual cases. It also aims to harmonize data protection requirements with real-life circumstances.

If the documentation of purpose and deletion routine is consistent, inquiries from supervisory authorities can also be answered easily and quickly.

What must companies consider when documenting the deletion concept?

When documenting the deletion concept, good planning and structure are essential components for achieving data protection compliance. This is also because companies must generally inform data subjects, when collecting personal data, how long this data will be stored. Even if this storage period is still undetermined at the time of data collection, the company must be able to inform the data owner about the principles of processing duration, which should ideally be considered in its deletion concept.

In the example of customer relationships, companies will in the future not be able to avoid informing customers about the collection, processing, and duration of data storage already at the time of contract conclusion or account creation. Even if carefully defined purposes in the deletion concept often allow for more precise determination of storage periods, the time will come when data must actually be deleted. Since selective deletion of individual data encounters technical difficulties, a deletion concept will establish corresponding temporal rhythms for the deletion of larger data sets. Here too, consistent and comprehensive documentation is particularly important to clearly identify what, when, why, and how data is definitively deleted.

What must a deletion concept contain?

A deletion concept comprises several points that should answer the following questions

• What types of data are collected in the company? Here, it is best to distinguish between different categories such as customer data, employee data, and partner data.
• What deletion periods apply? Define deletion rules and specific regulations. What takes precedence in individual cases and carries more weight? Legitimate interest or statutory retention period? Important: Employee data must be handled differently from customer data. Also differentiate by department: Different data is generated in HR than, for example, in marketing. Accordingly, different requirements apply.
• Where is data that needs to be deleted stored? Identify and document the individual systems where data is stored. In which backups, mailing lists, Excel spreadsheets, and ticketing systems do you process personal data? It is crucial to clarify whether the data has been shared, as all data records must be deleted there too, once the retention period expires, a deletion request is submitted, or the data's purpose has been fulfilled.
• Who is responsible? Appoint a person responsible for handling deletions. Additionally, designate a deputy in case the primary person responsible is unavailable – you must act within a few hours when responding to a data subject request.
• Are deletion processes traceable? Maintain appropriate and traceable documentation of each process to comply with the accountability and documentation requirements of the GDPR.

Important: If a deletion concept is established within a company, it means that ALL existing legacy data must be reviewed and subjected to this concept. This can be time-consuming, but it can protect your company from a potentially expensive data protection violation.

Example: Deletion Matrix

The following deletion matrix shows at a glance, which data needs to be deleted when, where it is stored, and how the deletion is verifiably carried out.

Important: Data transfers to service providers must be documented as separate storage locations (ensure deletion there).

Guide: How to create a deletion concept?

There is no universal template for a deletion concept, as it varies greatly not only by company but also by department. Nevertheless, we can assist you with the fundamental creation of a deletion concept.

• To create a deletion concept suitable for your company, first go through the questions above step by step, working your way through each business area. This is the best approach to creating a deletion concept template.
• After answering the questions, you should define the legal basis for each department's collection and storage of personal data and place it at the beginning of the deletion concept. This allows your employees to immediately access the relevant information.
• Now create a table listing all relevant points of the deletion concept. This table must, of course, also be adapted to the respective business area.

This exemplary GDPR deletion concept template serves merely as a guide. Should you have any questions or require assistance with its implementation, please speak with your data protection officer or contact us.

Conclusion on the GDPR Deletion Concept: It's no longer optional

In the future, no company will be able to operate without a qualified deletion concept for personal data. This topic is complex and cannot be adequately addressed with a simple GDPR deletion concept template. Especially in areas where a lot of personal data is processed, a well-founded deletion concept is extremely important and should not be underestimated, though it often proves to be very complex.

Get expert advice from Proliance now and let us help you implement your individual data deletion concept. A robust deletion concept establishes one of the essential foundations for your company's data protection compliance.