GDPR erasure obligations: deleting documents correctly and verifiably
The GDPR obliges businesses to delete personal data as soon as the purpose of the processing no longer applies and there is no longer any statutory retention obligation – and this deletion must be organised in a verifiable way. So the tension is clear from the outset: tax and company law require documents to be kept for years, data protection requires deletion on time. The apparent contradiction is resolved by a deletion policy that defines, for each document class, when which rule applies.
In brief
- From the principle of storage limitation and the right to erasure it follows that personal data may only be stored for as long as the purpose or a legal obligation requires.
- A retention obligation beats a request for deletion: as long as, for example, the seven-year period for books and supporting documents is running, the document may and must stay – even if a customer asks for it to be deleted.
- Once the retention period has expired, the situation is reversed: there is then no basis for further storage, and the obligation to delete applies.
- A deletion policy translates this logic into document classes, periods, responsibilities and a recurring deletion run.
- The GDPR’s accountability obligation requires verifiability: a deletion log documents what was deleted, when and under which rule – without the content itself.
- All of this depends on a filing system in which documents can be found at all: what nobody can find, nobody can delete on time.
Where does the obligation to delete actually come from?
Two provisions of the GDPR underpin the obligation to delete. The principle of storage limitation (Art. 5) requires that personal data be kept in a form that permits identification only for as long as is necessary for the purpose. This applies automatically, without anyone having to submit a request: once the purpose has been fulfilled and there is no other legal basis, further storage is not permitted. In addition, there is the right to erasure (Art. 17), which data subjects can actively assert.
Both are subject to the accountability obligation: the business must be able to demonstrate compliance with the principles. So it is not enough to delete at some point – you must be able to show which rules govern deletion. The legal texts can be accessed in the Austrian federal legal information system RIS (ris.bka.gv.at); the Austrian Data Protection Authority is responsible for complaints from data subjects. This article provides general guidance and does not replace legal advice in individual cases.
Why may you still not delete many documents immediately?
Because the obligation to delete expressly gives way as long as other legal obligations require retention. The most important ones for Austrian SMEs: under tax and company law, books, records and supporting documents must generally be kept for seven years – longer in special cases, for example for documents relating to real estate or as long as proceedings are pending for which the documents are relevant. Defending against possible legal claims can also justify longer storage, for example within warranty and limitation periods.
In practice, this means: if a former customer demands the deletion of “all their data”, the correct answer is a nuanced one. Invoices and accounting records stay until the period expires – here the exception for a legal obligation applies. The newsletter entry and the second profile that was never needed, on the other hand, must be deleted. Deleting everything across the board would be just as wrong as refusing across the board.
For rough guidance (this list is not exhaustive):
| Document class | Typical handling | What the period is based on |
|---|---|---|
| Accounting records, invoices | Generally keep for seven years, then delete | Retention obligation under tax and company law |
| Contracts and related correspondence | Keep beyond the term as long as claims are conceivable | Warranty and limitation periods |
| Application documents of rejected applicants | Delete promptly after the procedure has been completed, unless there is consent to keep them on file | Possible periods for asserting claims arising from the application procedure |
| Newsletter and marketing data | Delete or block after withdrawal of consent or objection | Consent as the legal basis |
The specific periods for your business depend on the industry and the individual case – which is precisely why they should be properly worked out once and written into the deletion policy, with professional support if in doubt.
One more distinction: accounting documents belong in their system of record – accounting or the ERP. Retention is handled there, technically and organisationally, and that is where it stays. A deletion policy must, however, cover all storage locations in which copies and accompanying documents are kept: the file server, the email inboxes, the project folders. Experience shows that the problem rarely lies in the ERP, but in the side stores that have built up over time, where the same invoice sits forgotten in three different folders.
What does a deletion policy look like in outline?
A deletion policy does not have to be a thick volume. For an SME, a structured document created in six steps is enough:
- Data inventory: The starting point is the record of processing activities – the internal register of all data processing that the GDPR requires anyway. Add where the related documents are actually stored: ERP, file server, inboxes, cloud folders.
- Define document classes: Group similar documents together – accounting records, contracts, personnel files, applications, marketing data. One line per class, not per individual document.
- Set periods: For each class, determine the applicable rule: statutory retention obligation, limitation considerations or simply that the purpose no longer applies. The result is a period plus a starting point (for example: end of the financial year, end of contract, rejection).
- Assign responsibilities and the process: Who carries out the deletion, who approves it, what happens with borderline cases? Without named responsibility, every policy remains theory.
- Schedule the deletion run: A fixed date each year – many businesses choose the first quarter, when the annual financial statements bring order anyway – on which you work through all classes that are due.
- Log and improve: Document every run, note stumbling blocks, refine the policy.
How do you delete verifiably – without keeping the data?
The proof is a deliberately sparse deletion log: it records the document class, the period concerned, the rule applied from the deletion policy, the date of deletion and the person who carried it out. The deleted content is not recorded – otherwise the deletion would be undermined by its own proof. For deletion requests from data subjects, the reply to the person is added: what was deleted and what is still being kept, and on what grounds.
Two practical questions come up regularly. First, backups: backups usually cannot be cleaned of individual records selectively. Common and documentable practice is to set out the retention cycles of the backups in the deletion policy – backups are overwritten after a fixed period – and to ensure that data already deleted is removed again if a backup is restored. Second, the “forgotten in side stores” problem: the personnel file has been deleted, but the scan is still in the inbox of the person who used to handle it. Discoveries like these are the main reason why the data inventory at the start must be thorough.
What does this mean for your digital filing?
The uncomfortable truth: erasure obligations require order. Anyone who does not know where which documents are stored can neither delete on time nor reply correctly to a data subject. A structured filing system with clear classes is therefore not a data protection add-on, but the foundation.
And the deletion policy itself must be within reach in everyday work. When a colleague in administration wants to know how long applications are kept, the answer should not depend on someone’s memory. An AI knowledge base that answers from your own sets of rules and names the source answers such questions directly from the deletion policy – “Which period applies to rejected applications, and who deletes them?” – and so turns the document into everyday practice. The division of roles is clear: accounting remains the system of record for accounting documents; the knowledge base supplies the how and why. The overview article AI and GDPR in Austria shows how the deletion policy, data processing agreements and server location fit into the overall picture of GDPR-compliant AI use.
The next step is a single table: this week, list your five most important document classes with their storage location and the period you assume applies – that is the core of every deletion policy. The introduction process page then shows how to make your rules available for the whole team to query.
Frequently asked questions
How long must business records be kept in Austria?
Under tax and company law, books, records and supporting documents must generally be kept for seven years; in certain cases – for example for documents relating to real estate or pending proceedings – for longer. Only once these periods have expired does the question of erasure under the GDPR arise.
Do I have to delete data immediately if a customer asks me to?
Not always. The right to erasure does not apply as long as statutory retention obligations exist or the data is needed to establish, exercise or defend legal claims. In such cases, processing is restricted instead of the data being deleted – and the data subject receives a reasoned reply.
What is a deletion policy?
A deletion policy is the internal set of rules that defines which types of data and document classes are deleted after which periods, who is responsible for this and how the deletion is documented. It translates the abstract obligation of storage limitation into concrete, repeatable processes.
How do I prove a deletion without keeping the data?
With a deletion log that records the data category, the period concerned, the date of deletion, the rule applied and the person who carried it out – but not the deleted content itself. This way you meet the accountability obligation without undermining the deletion.
Must deleted data also disappear from backups?
Backup copies usually cannot be cleaned selectively for technical reasons. Common practice is to set out the backup cycles in the deletion policy, so that backups are overwritten after a fixed period, and to delete any data that was already deleted again if a backup is restored. For individual cases, professional advice is recommended.