Case study: Retention and destruction management

This is an illustrative (representative) scenario about retaining and destroying personal data; it does not represent a real customer.

This content is for general information only and does not constitute legal advice.

Situation

At an organization, CV, employee and candidate data were stored indefinitely. There was no retention-period policy, periodic destruction schedule or destruction minutes.

Risks

• Indefinite, unnecessary retention (contrary to data minimization).
• Retention periods not defined per data type.
• No periodic destruction process or schedule.
• No records/minutes of destruction operations.

Measures applied

1. Retention matrix: Legal/functional retention periods set per data type.
2. Retention & destruction policy: Process and responsibilities documented.
3. Periodic destruction schedule: Regular destruction set up for expired data.
4. Minutes & records: Destruction operations recorded (kept for at least three years).

Result

Data whose period has expired is now deleted, destroyed or anonymized regularly, traceably and in line with regulation.