Data Deletion Policy & Retention Periods
A data deletion policy sets out systematically when and how a company deletes personal data once the purpose of processing no longer applies or statutory retention periods have expired. It puts the storage limitation principle (Art. 5(1)(e) GDPR) and the erasure obligations of Art. 17 GDPR into practice.
In practice
In practice a deletion policy pairs data types such as customer, applicant or newsletter data with the retention periods that apply under tax, commercial or employment law, and defines who technically carries out and documents deletion once a period has run out. There is no single statutory deletion period covering all data types — the actual duration follows from the purpose of processing and from any applicable specific legislation. A documented deletion policy helps you demonstrate to a supervisory authority that data is not kept longer than necessary, and it creates clear responsibilities for deletion routines in CRM, newsletter tools or accounting systems.