Create a deletion concept – manage classes, rules and retention periods

A deletion concept documents which personal data is deleted, when and how – implementing the principle of storage limitation under Art. 5(1)(e) GDPR. preeco | data protection follows the structure of the DIN 66398 standard.

1. Create a new deletion concept: In the left menu click „Deletion policy" and then „Deletion policies". Open the arrow next to „New", choose „Create deletion concept", give it a name – typically the name of the responsible company – and assign it to an organisation.
2. Maintain standard retention periods: Store reusable retention durations (e.g. 3650 days = 10 years under German commercial and tax law). You then reference these periods in several deletion rules, so changes only have to be made in one place.
3. Add deletion classes: Via „New" in the „Deletion classes" section you bundle similar data with the same start point (collection, end of the process, or end of the relationship with the data subject) and assign data categories, data processing systems and individual data fields.
4. Define deletion rules: Via „New" in the „Deletion rules" section you combine a deletion class with a standard retention period, a specific triggering event and the type of process (delete, anonymise, pseudonymise or block). Set the type of implementation, assign the rule to a responsible person, and add the performing party under „Person responsible" – internal or an external processor.
5. Release: „Release" turns the deletion concept into a versioned, auditable state and activates it for follow-ups.

Tip: Only release a concept once every deletion class is assigned to at least one deletion rule and each rule has a standard retention period and a responsible person – only then is storage limitation fully documented towards the supervisory authority.