The statutory retention periods are an important reference point for a company's deletion concept and should be documented in it.

As a rule, personal data must be deleted according to the GDPR when it loses its purpose or when the data subject requests deletion.

In some cases, however, there is a legal regulation (retention period) that prescribes a minimum period for the storage period.

To resolve these deletion conflicts, companies need an up-to-date deletion concept and should document the legal basis for the respective retention period in each individual case. You can either enter this manually or have it automated by a modern software solution such as caralegal for your data protection management.