In short: Personal data may only be stored as long as necessary for the purpose or due to statutory retention obligations (storage limitation, Art. 5 GDPR). After that, it must be deleted. A deletion concept defines which data is deleted when and how.
The tension: retain vs. delete
On one hand, commercial and tax law require many documents to be retained for years. On the other, the GDPR requires deletion once the purpose no longer applies (Art. 17 – right to erasure). The solution: data with a retention obligation is kept/blocked until the period expires and then reliably deleted.
The deletion concept (DIN 66398)
A deletion concept assigns data types to deletion classes with defined periods and sets responsibilities and procedures. Typical building blocks:
- Inventory of data types and their legal bases
- Deletion periods per data type (start, duration)
- Deletion procedure and evidence
- Responsibilities and controls
Sovereignty and processing
Where data is stored is part of GDPR compliance. Hosting in German data centres without US subcontractors avoids the uncertainties of third-country transfers. For the software you use, you need a data processing agreement (DPA).
How Aktenplatz helps
Retention periods can be stored per document; after expiry you delete in a GDPR-compliant way – automatically or after approval. Fine-grained permissions, a complete audit trail and hosting in Germany support a robust deletion concept.
Note: This article offers general guidance to the best of our knowledge (as of 2026) and does not constitute legal or tax advice. The applicable statutory rules and your tax adviser are authoritative.