GDPR erasure obligations: deleting documents correctly and verifiably
The GDPR obliges businesses to delete personal data as soon as the purpose of the processing no longer applies and there is no longer any statutory retention obligation – and this deletion must be organised in a verifiable way. The area of tension is therefore clear from the outset: tax and company law require documents to be kept for years, data protection requires deletion on time. The apparent contradiction is resolved by a deletion policy that defines, for each document class, when which rule applies.
In brief
- From the principle of storage limitation and the right to erasure it follows that personal data may only be stored for as long as the purpose or a legal obligation requires.
- A retention obligation beats a request for deletion: as long as, for example, the seven-year period for books and supporting documents is running, the document may and must stay – even if a customer asks for it to be deleted.
- Once the retention period has expired, the relationship reverses: there is then no basis for further storage, and the obligation to delete applies.
- A deletion policy translates this logic into document classes, periods, responsibilities and a recurring deletion run.
- The GDPR’s accountability obligation requires verifiability: a deletion log documents what was deleted, when and under which rule – without the content itself.
- The prerequisite for everything is a filing system in which documents can be found at all: what nobody can find, nobody can delete on time.
Where does the obligation to delete actually come from?
Two provisions of the GDPR underpin the obligation to delete. The principle of storage limitation (Art. 5) requires that personal data be kept in a form that permits identification only for as long as is necessary for the purpose. This applies automatically, without anyone having to submit a request: once the purpose has been fulfilled and there is no other legal basis, further storage is not permitted. In addition, there is the right to erasure (Art. 17), which data subjects can actively assert.
Both are subject to the accountability obligation: the business must be able to demonstrate compliance with the principles. So it is not enough to delete at some point – you must be able to show according to which rules deletion takes place. The legal texts can be accessed in the Austrian federal legal information system RIS (ris.bka.gv.at); the Austrian Data Protection Authority is responsible for complaints from data subjects. This article provides general guidance and does not replace legal advice in individual cases.
Why may you still not delete many documents immediately?
Because the obligation to delete expressly gives way as long as other legal obligations require retention. The most important ones for Austrian SMEs: under tax and company law, books, records and supporting documents must generally be kept for seven years – longer in special cases, for example for documents relating to real estate or as long as proceedings are pending for which the documents are relevant. Defending against possible legal claims can also justify longer storage, for example within warranty and limitation periods.
In practice, this means: if a former customer demands the deletion of “all their data”, the correct answer is a differentiated one. Invoices and accounting records stay until the period expires – here the exception for a legal obligation applies. The newsletter entry and the second profile that was never needed, on the other hand, must be deleted. A blanket complete deletion would be just as wrong as a blanket refusal.
For rough guidance, without any claim to completeness:
| Document class | Typical handling | What the period is based on |
|---|---|---|
| Accounting records, invoices | Generally keep for seven years, then delete | Retention obligation under tax and company law |
| Contracts and related correspondence | Keep beyond the term as long as claims are conceivable | Warranty and limitation periods |
| Application documents of rejected applicants | Delete promptly after the procedure has been completed, unless there is consent to keep them on file | Possible periods for asserting claims arising from the application procedure |
| Newsletter and marketing data | Delete or block after withdrawal of consent or objection | Consent as the legal basis |
The specific periods for your business depend on the industry and the individual case – which is exactly why they should be determined properly once and written into the deletion policy, with professional support if in doubt.
One more distinction: accounting documents belong in the leading system – accounting or ERP. There, retention is regulated technically and organisationally, and that is where it stays. A deletion policy must, however, cover all storage locations in which copies and accompanying documents are kept: the file server, the email inboxes, the project folders. Experience shows that the problem rarely lies in the ERP, but in the side stores that have grown over time, in which the same invoice lies dormant three times in different folders.
What does a deletion policy look like in outline?
A deletion policy does not have to be a thick volume. For an SME, a structured document created in six steps is enough:
- Data inventory: The starting point is the record of processing activities – the internal register of all data processing that the GDPR requires anyway. Add where the related documents are actually stored: ERP, file server, inboxes, cloud folders.
- Form document classes: Group similar documents together – accounting records, contracts, personnel files, applications, marketing data. One line per class, not per individual document.
- Set periods: For each class, determine the applicable rule: statutory retention obligation, limitation considerations or simply that the purpose no longer applies. The result is a period plus a starting point (for example: end of the financial year, end of contract, rejection).
- Assign responsibilities and the process: Who carries out the deletion, who approves it, what happens with borderline cases? Without named responsibility, every policy remains theory.
- Schedule the deletion run: A fixed date each year – many businesses choose the first quarter, when the annual financial statements bring order anyway – on which all classes that are due are gone through.
- Log and improve: Document every run, note stumbling blocks, sharpen the policy.
How do you delete verifiably – without keeping the data?
Proof is provided by a deletion log that is deliberately sparse: it records the document class, the period concerned, the rule applied from the deletion policy, the date of deletion and the person who carried it out. The deleted content is not recorded – otherwise the deletion would be undermined by its own proof. For deletion requests from data subjects, the reply to the person is added: what was deleted and what is still being kept, and on what grounds.
Two practical questions come up regularly. First, backups: backups usually cannot be cleaned of individual records selectively. Common and documentable practice is to set out the retention cycles of the backups in the deletion policy – backups overwrite themselves after a fixed period – and to ensure that data already deleted is removed again if a backup is restored. Second, the “forgotten in side stores” problem: the personnel file has been deleted, but the scan is still in the inbox of the former case handler. Finds like these are the main reason why the data inventory at the start must be thorough.
What does this mean for your digital filing?
The uncomfortable truth: erasure obligations require order. Anyone who does not know where which documents are stored can neither delete on time nor reply correctly to a data subject. A structured filing system with clear classes is therefore not a data protection add-on, but the foundation.
And the deletion policy itself must be within reach in everyday work. When a colleague in administration wants to know how long applications are kept, the answer should not depend on someone’s memory. An AI knowledge base that answers from your own sets of rules and names the source answers such questions directly from the deletion policy – “Which period applies to rejected applications, and who deletes them?” – and thus turns the document into lived practice. The division of roles is clear: the leading system for accounting documents remains accounting; the knowledge base supplies the how and why. How the deletion policy, data processing agreements and server location fit into the overall picture of GDPR-compliant use of AI is shown in the overview article AI and GDPR in Austria.
The next step is a single table: this week, list your five most important document classes with their storage location and the period you assume applies – that is the core of every deletion policy. How you then make your sets of rules available for the whole team to ask questions of is shown on the page introduction process.
Frequently asked questions
How long must business records be kept in Austria?
Under tax and company law, books, records and supporting documents must generally be kept for seven years; in certain cases – for example for documents relating to real estate or pending proceedings – for longer. Only once these periods have expired does the question of erasure under the GDPR arise.
Do I have to delete data immediately if a customer asks me to?
Not always. The right to erasure does not apply as long as statutory retention obligations exist or the data is needed to establish, exercise or defend legal claims. In such cases, processing is restricted instead of the data being deleted – and the data subject receives a reasoned reply.
What is a deletion policy?
A deletion policy is the internal set of rules that defines which types of data and document classes are deleted after which periods, who is responsible for this and how the deletion is documented. It translates the abstract obligation of storage limitation into concrete, repeatable processes.
How do I prove a deletion without keeping the data?
With a deletion log that records the data category, the period concerned, the date of deletion, the rule applied and the person who carried it out – but not the deleted content itself. This way you meet the accountability obligation without undermining the deletion.
Must deleted data also disappear from backups?
Backup copies usually cannot be cleaned selectively for technical reasons. Common practice is to document the backup cycles in the deletion policy, so that backups are overwritten after a fixed period, and to remove data that has already been deleted again if a backup is restored. For individual cases, professional advice is recommended.