Personal Data Destruction and Periodic Disposal: How To

Personal data cannot be kept indefinitely. When the purpose of processing disappears or the statutory retention period expires, data must be disposed of by an appropriate method. This article covers disposal methods, the retention-and-destruction policy and periodic disposal discipline.

This content is for general information only and does not constitute legal advice.

Disposal methods: deletion, destruction, anonymization

The relevant regulation defines three methods:

• Deletion: Making data inaccessible and unusable in any way for relevant users.
• Destruction: Making data inaccessible, irretrievable and unusable by anyone (for example, destroying physical media).
• Anonymization: Making data impossible to associate with a person even when matched with other data.

Which method to choose depends on the data type, its medium and the processing purpose.

Retention and destruction policy

Data controllers with a VERBİS registration obligation are expected to prepare a personal data retention and destruction policy. This policy defines data categories, retention periods and disposal methods. It must be consistent with your real processing activity and your data inventory.

Periodic disposal

Data whose retention period has expired must be disposed of at regular intervals. According to the relevant regulation, periodic disposal is carried out at intervals of no more than 6 months. Tracking this period and which data to dispose of is prone to being forgotten in manual processes.

Common mistakes

• Not setting retention periods. Disposal cannot be planned without a defined period.
• Not documenting disposal. If there is no record that data was disposed of, it cannot be proven in an audit.
• Forgetting backups. Data deleted in the main system may persist in backups.

Managing the process

Disposal requires tracking retention periods, automatic alerts and disposal records. Kivuz KVKK is a KVKK compliance software that produces disposal alerts for expired data and records the operations. Disposal is one stage of the broader KVKK compliance process; to see the whole, request a demo.