What does this mean in practice?

In practice, the creation of a deletion concept has proven to be expedient. Firstly, the data categories that are processed in your company are recorded in a table. A further column is then used to enter when the purpose for which the data was originally collected no longer applies (e.g. "on completion of the project"). Additional columns can now be used to list supplementary laws or regulations that require the continued storage of the data. Finally, a deletion rule is defined for each data category: Who deletes the data, how and when?

Task

When, how and by whom is data deleted in your organisation? Is there a deletion concept? Your organisation's data protection officer should be able to answer this question.

The creation of a deletion concept or the deletion of data affects the entire organisation and not just the individual project. The responsibility therefore lies with the management of your organisation. As project manager or project participant, you are not responsible for creating a deletion concept. If your project has special requirements with regard to the deletion of data, you should inform those responsible.

As a rule, a deletion concept also defines who is responsible for deleting individual data. These are often organisational areas such as internal IT or the HR department. 

If your organisation does not yet have a deletion concept, you should suggest this to the relevant departments. 

Templates and documents

• Template of a erasure concept in tabular form (docx-File)
• Information reg. erasure concept (pdf-Filei)