The statutory retention periods are an important point of reference for a company's deletion concept and should be documented in it.

As a rule, according to the GDPR, personal data must be deleted when it loses its purpose or when the data subject requests its deletion.

In some cases, however, there is a legal regulation (retention period) that stipulates a minimum period for the storage period.

In order to resolve these deletion conflicts, companies require an up-to-date deletion concept and should document the legal basis for the respective retention period in each individual case. You can either enter this manually or have it automated by a modern software solution such as caralegal for your data protection management.