Data Destruction under the GDPR: Methods and Deadlines

You must delete or destroy personal data as soon as the purpose ceases and no retention obligation stands in the way (Art. 5(1)(e), Art. 17 GDPR). Which method you choose depends on the storage medium; the GDPR does not prescribe a specific method, Art. 32 GDPR requires measures that are appropriate to the risk.

Old job applications in the recycling bin, dusty databases, or forgotten cloud backups — when it comes to data destruction, many companies overlook how important the "correct" handling of personal data really is. Under the GDPR, data may only be stored for as long as it's genuinely needed — after that, it must be deleted or destroyed. But what does that mean in practice?
In this article, you'll learn when data destruction is necessary, which methods are GDPR-compliant, and which mistakes you should absolutely avoid. With practical tips, a checklist, and guidance on deletion concepts, you'll be perfectly prepared — both digitally and on paper.

What Happens to Your Data When It's "Gone"?

Whether it's customer data on an old laptop, application documents in the recycling bin, or cloud backups — data is quickly stored, but "properly" deleting it is often forgotten. And it's not just about tidiness or storage space. If personal data is deleted incompletely or improperly, you risk serious data protection violations.

The GDPR stipulates that personal data may only be stored for as long as it's needed for a legitimate purpose. As soon as that purpose no longer applies, the data must be deleted or destroyed — in a way that's GDPR-compliant, traceable, and demonstrable.

Many companies, however, fail at exactly this point: backups are overlooked, paper files remain in the archive, or outdated databases are ignored. Yet data destruction is a central component of an effective data protection management program.

What Does the GDPR Say About Data Destruction?

The General Data Protection Regulation (GDPR) obligates companies to practice data minimization and storage limitation (Art. 5(1)(c) and (e) GDPR). As soon as data is no longer needed for its original purpose, it must be deleted — securely.

Right to erasure (Art. 17 GDPR): 

Data subjects have the right to request the erasure of their data without undue delay if one of these grounds applies (Art. 17(1) GDPR):

• the purpose of processing no longer applies,
• consent has been withdrawn and there is no other legal basis,
• the data subject objects under Art. 21 (under Art. 21(1) only if there are no overriding legitimate grounds for the processing),
• data was processed unlawfully,
• or a legal obligation to erase the data exists.

The right does not apply to the extent that processing is necessary, for example for compliance with a legal obligation, such as a statutory retention obligation, or for the establishment, exercise or defence of legal claims (Art. 17(3)(b) and (e) GDPR). You can read the full text at gdpr-info.eu (Art. 17 GDPR). For how the right to erasure affects AI models, see the right to be forgotten and AI models.

Deleting, Destroying, Anonymizing: What Is the Difference?

The three terms differ in what happens to the data or the data carrier:

• Deletion: data can no longer be found or reconstructed.
• Destruction: data is physically or technically destroyed so that it can no longer be recovered (e.g., through shredding or secure deletion software).
• Anonymization: data is altered so that it can no longer be attributed to any individual.

Simply deleting data is often not enough — for particularly sensitive data or physical media, destruction is required.

When Do You Have to Delete or Destroy Data?

You have to delete or destroy data when the purpose has ceased and no retention obligation applies any longer (Art. 5(1)(e) GDPR), or when a right to erasure under Art. 17 GDPR exists. Here are the most important situations explained in detail:

1. After statutory retention periods expire
Much data, particularly from accounting, must be stored for a specific period for tax or commercial law reasons (depending on the document 6, 8 or 10 years, see the table below). Once these periods expire, the retention obligation ends. If you do not need the data for any other purpose either, you must delete it (Art. 5(1)(e), Art. 17(1)(a) GDPR); continuing to store it without reason violates the storage limitation principle.

2. When consent is withdrawn
If a data subject has given consent to the processing of their personal data, they can withdraw it at any time. From that point on, the data may no longer be processed and must — unless another legal basis applies — be deleted or destroyed.

3. When the purpose no longer applies
Once data has fulfilled its original purpose — for example, after a project or job application has concluded — its continued storage is no longer justified. It must therefore be deleted or destroyed. Good data management ensures such cases are regularly identified and processed automatically.

4. Upon a justified erasure request
Data subjects can request the erasure of their data without undue delay under the conditions of Art. 17(1) GDPR. An access request under Art. 15 GDPR, on the other hand, does not lead to erasure: it gives the data subject the right of access to the stored data and to information, among other things, about the existence of the right to erasure. If a right to erasure exists, companies must completely and securely delete or destroy the data in question — including from backups, where technically feasible. Read more about access requests in Right of access under the GDPR.

5. When switching data processing service providers
When switching a cloud service, HR software, or another external provider, personal data at the previous provider must be deleted or destroyed. Important: this should be regulated in the Data Processing Agreement (DPA) and documented in a verifiable way.

Which Retention Periods Apply Before You Delete?

Statutory retention periods apply before destruction in Germany: 10 years for books, inventories and annual accounts, 8 years for accounting vouchers and 6 years for commercial and business letters (Section 147(3) of the German Fiscal Code (AO), Section 257(4) of the German Commercial Code (HGB)). A statutory retention obligation is a legal obligation that can stand in the way of a right to erasure under Art. 17(3)(b) GDPR.

The period starts at the end of the calendar year in which the relevant event was completed, for example when the voucher was created or the letter was received. Under the German Fiscal Code, the period does not expire as long as the documents are relevant for taxes whose assessment period has not yet expired.

How Do You Destroy Paper, Hard Drives and SSDs?

The GDPR does not prescribe a specific method; Art. 32 GDPR requires measures that are appropriate to the risk. In its module CON.6 Löschen und Vernichten (Edition 2023, in German), the German Federal Office for Information Security (BSI) names minimum procedures for each type of data carrier. The selection at a glance:

1. Physical media (paper, USB drives, hard drives):

• Shredding according to ISO/IEC 21964 (builds on DIN 66399)
• Degaussing
• Thermal destruction

2. Digital data:

• Complete overwriting with random values or, for encrypted data carriers, secure deletion of the key (BSI CON.6.A12)
• Complete deletion of backups
• No simple "deleting" via the recycling bin or formatting

According to the BSI, the ISO/IEC 21964 series builds on DIN 66399. For protection classes and particle sizes, check the standard currently in force. Document the chosen procedures as part of your technical and organizational measures (Art. 32 GDPR).

How Do You Delete Data in the Cloud and in Backups?

In the cloud and with external providers, you regulate deletion by contract: under Art. 28(3)(g) GDPR, the controller decides whether the processor deletes or returns all personal data after the end of the services; existing copies must be deleted unless a legal provision requires storage. You must include backups in the deletion process where necessary (BSI CON.6.A2).

Cloud services & external providers:

• Contractual provisions for data deletion (DPA)
• Choosing GDPR-compliant providers

When Do You Need a Service Provider for Destruction?

If you commission a service provider with the destruction, check whether it processes personal data on your behalf. In that case, the processing must be governed by a contract (Art. 28(3) GDPR), the data processing agreement. The BSI requires the provider’s procedures to meet at least your internal requirements and recommends reviewing the provider regularly (CON.6.A11).

Which Mistakes Happen Often?

1. "Deleting" without true irretrievability
Many companies rely on simply pressing "delete" or moving files to the recycling bin. But such methods aren't sufficient to destroy data in a GDPR-compliant way. In many cases, data can be recovered with little effort — a real risk in the event of data breaches or audits. The BSI also points out that ordinary deletion functions of the operating system generally do not result in secure deletion. If data reaches unauthorized persons through improper disposal, check whether a reportable data breach has occurred (Art. 33 GDPR): Reporting a data breach step by step in 72 hours.

2. No documentation of the deletion process
The GDPR requires companies to handle personal data in a traceable way. Without traceable documentation of when, how, and by whom data was deleted, proof of compliance is often missing in case of doubt — a common criticism during data protection audits.

3. Data remnants in backups or shadow IT
Backups are often forgotten — even though personal data is stored there too. If data is deleted from the live system but remains in backup copies or uncontrolled systems (e.g., spreadsheets on personal devices), this constitutes a violation of the GDPR's storage limitation principle.

4. No clearly defined deletion concept
Without structured processes and clear responsibilities for data destruction, gaps emerge in data protection management. A deletion concept defines standards, responsibilities, and deletion deadlines — without one, data destruction quickly becomes a gray area within the company.

How Do You Document the Destruction?

You document which data was destroyed, when, by which method and by whom, because you must be able to demonstrate compliance with the principles (Art. 5(2) GDPR). The record of processing activities also contains, where possible, the envisaged time limits for erasure of the different categories of data (Art. 30(1)(f) GDPR): record of processing activities. The GDPR requires traceability and demonstrability. You should therefore document:

• which data was deleted and when
• which methods were used
• who is responsible
• whether deadlines were met

A deletion concept sets out which data is deleted after which periods, by whom and by which procedure. The BSI requires such a set of rules (CON.6.A1) and recommends documenting it in a policy (CON.6.A8).

Checklist: 5 Steps to GDPR-Compliant Data Destruction

• Identify data: What personal data exists, and where?
• Check retention periods: Which data may or must be destroyed?
• Choose the appropriate method: Paper, hard drive, or cloud?
• Document deletion: Time, method, person responsible
• Review regularly: Is your deletion concept up to date and effective?

Further reading: the BSI points out that ISO/IEC 27001:2013 sets requirements for media handling in Annex A.8.3, which also cover deletion and destruction; the article ISO 27001 vs. GDPR explains how the two fit together. To get started, the whitepaper GDPR in 30 minutes and the technical and organizational measures checklist help. For questions about your case, an external data protection officer can support you; an overview of the topic is available under GDPR compliance.