Point of law

Erasing, retaining, and justifying both

Erasure duties do not depend on a request for erasure. They follow directly from the storage limitation principle in Art. 5(1)(e) GDPR. The relevant retention periods run six, eight or ten years depending on the category of data, not a flat ten years. Where legacy systems remain in place, erasure does not happen by itself.

One erasure request, several systems

A former customer asks for her data to be erased. The customer database finds her at once. Whether she also sits in the newsletter system, the ticketing system, last year’s backup and the test environment, nobody knows. The clock is running.

An erasure request hits the question of storage locations

Handling an erasure request is usually the easier case in law. Where one of the grounds for erasure listed in Art. 17(1) GDPR applies, there is a right to erasure. The reply has to be given within one month. Under Art. 12(3) GDPR that period can be extended by up to two months.

Four steps within the deadline

Establish identity and scope
Art. 12(6) GDPR allows additional information where there are reasonable doubts. At the same time it has to be settled which processing the request covers.
Check the grounds
Art. 17(1) GDPR lists six grounds, paragraph 3 five counter-grounds. A statutory retention duty stands in the way of erasure and leads to restriction of processing under Art. 18 GDPR.
Implement across all systems
The right runs against the controller and not against a system. Backups, processors and test environments belong to it.
Notify recipients
Art. 19 GDPR requires notification of every recipient to whom the data was disclosed, unless that proves impossible or involves disproportionate effort.

The third step is where it fails. Without a list of storage locations per processing activity the completeness of an erasure cannot be shown, and the reply to the data subject asserts it all the same.

The duty to erase exists without a request

Whether data has to be erased without an application by the data subject follows from Art. 5(1)(e) GDPR itself. The permissible storage period ends when the purpose of the processing falls away. In its judgment of 20 October 2022 the Court of Justice of the European Union made clear that the controller has to be able to justify and demonstrate the storage period.

That sets the direction for a retention schedule. It records when erasure is required and where the period comes from. The fields for this sit in the record of processing activities, where Art. 30(1)(f) GDPR calls for the envisaged periods.

Ten years does not apply to everything

How long documents have to be kept is usually answered with ten years. The two relevant provisions grade by type of document.

The periods in section 257 HGB and section 147 AO

Ten years

Commercial books, inventories, opening balance sheets, annual and consolidated accounts, management reports and the organisational documents needed to understand them.

Eight years

Accounting vouchers. For credit institutions, insurers and investment firms they stay at ten years under section 257(4) sentence 2 HGB.

Six years

Commercial letters received and sent, and the remaining documents in so far as they matter for taxation.

When the period starts and when it extends

The period starts at the end of the calendar year in which the voucher arose or the accounts were adopted. Under section 147(3) sentence 5 AO it does not end while the assessment period is still running.

Retention duty and erasure duty

Retention duty	Merkmal	Erasure duty
Sections 257 HGB, 147 AOAlongside special rules, for instance from social and professional law.	Source	Art. 5(1)(e) GDPRAlongside Art. 17 GDPR upon request.
Specified documentsBooks, vouchers, commercial letters. Not every record touched by them.	Subject matter	Every processing activityBackups, logs and test data included.
Ten, eight, six yearsTen for books and accounts, eight for vouchers, six for the rest.	Duration	As long as necessaryTo be demonstrated by the controller, not presumed.
Displaces erasureArt. 17(3)(b) GDPR, but only for the document concerned.	Effect in conflict	Applies to everything elseThe rest of the record still has to be erased or restricted under Art. 18 GDPR.

A retention duty justifies keeping the document and not the continued operation of the system it sits in. That distinction is the core of a workable retention schedule.

In a legacy system no period ends by itself

What happens to the data of a decommissioned system is rarely decided deliberately and is often settled by simply letting it persist. Decommissioning regularly ends the original purpose of the processing, while existing retention duties continue to apply. In between, a data holding arises for which clear responsibility is often no longer exercised.

What a decommissioning has to settle

Which documents are subject to a retention duty and in what form they have to be held
Whether section 147(6) AO applies, which after a change of system allows a machine-evaluable medium once five years have passed, provided no tax audit has begun
Which data migrates and which stays in the legacy holding, with a reason for both
Who erases the backups of the legacy system, and when
Whether a test environment with live data exists, and how it ends

How we support you with the deletion concept

A retention schedule rests on the same basis as the record of processing activities. For every processing operation the erasure period, the point at which that period starts to run and the unit responsible for carrying it out have to be settled. Where no responsibility is assigned, the schedule has no practical effect.

How long documents have to be kept to defend against civil claims follows from limitation periods and therefore not from data protection law. That assessment, and the question of what evidence litigation requires, runs through the affiliated law firm.

Frequently asked questions

Is erasure required without a request?

Yes. Art. 5(1)(e) GDPR limits storage to the period necessary for the purposes, regardless of whether anyone asks. The Court of Justice added on 20 October 2022 that the controller has to be able to demonstrate that period.

Does ten years always apply?

No. Section 257(4) HGB and section 147(3) AO grade the periods by type of document: ten years for books, inventories and accounts, eight years for accounting vouchers, six years for the rest. For credit institutions and insurers, vouchers stay at ten years.

What applies to a decommissioned system?

The purposes of the original processing end with decommissioning, the retention duties do not. Section 147(6) AO allows the data, after a change of system, to be held only on a machine-readable and machine-evaluable medium once the fifth calendar year has passed, provided no tax audit has begun.

Is blocking enough instead of erasing?

Only where a retention duty stands in the way of erasure. Restriction of processing under Art. 18 GDPR then takes its place, and access has to be confined to fulfilling that duty. A note in the file without technical effect does not achieve this.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.