Retention schedule

A retention schedule is the structured, documented definition of retention and deletion periods for each type of personal data and processing purpose. It translates the storage-limitation principle of Art. 5(1)(e) GDPR into concrete rules: for every category of personal data it determines the legal basis on which it is processed, how long it is needed, and when it must be deleted or anonymised. This turns the erasure obligation from an abstract requirement into a traceable, auditable process.A good retention schedule links each data type to the start of the period (such as the end of a contract, the last business contact, or the close of a calendar year), the duration of the period, and the triggering event. It must account for statutory retention obligations, in particular the commercial and tax-law periods under Section 257 of the German Commercial Code (HGB) and Section 147 of the Fiscal Code (AO), which run from six to ten years, and weigh these against the data-protection erasure obligation. Where a retention obligation applies, the data is usually blocked or its processing restricted and only finally deleted once the period has expired.The retention schedule forms part of the accountability obligation under Art. 5(2) GDPR and should be interlinked with the record of processing activities, which under Art. 30(1)(f) GDPR is itself meant to state the envisaged deletion periods. In practice it is complemented by a deletion concept that describes the organisational and technical measures for actually carrying out the erasure. The DIN 66398 standard offers a recognised methodology that groups data types into deletion classes with uniform standard periods.