A deletion concept is used to determine when, how and by whom personal data is to be deleted in the company.

Deletion periods provide information on when the data must be regularly deleted. Statutory retention obligations must be taken into account. As a rule, these are not to be found in data protection laws, but in tax or commercial laws, for example. In certain cases, however, data must also be deleted regardless of a deletion period - for example, if the person withdraws consent to marketing activities and the data may no longer be lawfully processed for other purposes.

In principle, a deletion concept can be created in various forms (e.g. electronically or on paper). However, it is advisable to make the concept available for document export so that any requests from supervisory authorities can be dealt with quickly and easily.

The concept should be designed and written as clearly as possible (technical terms should always be explained) so that all persons entrusted with the deletion can use it as a working basis.

With regard to the method of deletion, it is crucial to ensure that the data is irreversibly deleted, i.e. that it can no longer be restored after the deletion process in such a way that it can be used to draw conclusions about the person.