As early as the 24th,. Activity Report of the Federal Commissioner for the Data protection and the Freedom of Information Act for 2011 and 2012 was criticized because many companies lacked clear regulations regarding Deletion personal data was missing. Peter Schaar, who was the Federal Data Protection Commissioner at the time, pointed out that companies were dealing with the Deletion often struggle with digital data and keep data they no longer need for too long.
This observation remains relevant to this day. Under the General Data Protection Regulation, the obligation to Deletion The rules governing personal data have been clarified even further. Art. 5, para. 1, subparagraph e GDPR obligated Responsible persons Regarding memory limits: Personal data may be stored only for as long as is necessary for the respective processing purposes. In addition, Article 17 specifies GDPR the right to Deletion. Companies therefore do not have to wait for a request to delete data before taking action; instead, they must actively manage their data holdings.
A Data Deletion Policy as the Foundation for Data Protection Compliance
A Fire Suppression Plan It specifies which personal data is processed in which systems, how long it may be retained, and when it must be deleted or anonymized. It establishes clear responsibilities, documented processes, and traceable retention periods.
The DIN 66398 standard serves as a recognized guideline in this regard. It describes a structured approach for developing a disposal plan and determining disposal deadlines for personal data. Among other things, the standard recommends identifying data types, defining deletion rules, and assigning data sets to so-called deletion classes.
Deletion classes help companies reduce the complexity of various retention and deletion requirements. Data with comparable legal, business, or technical requirements are grouped together and assigned uniform deletion rules. This makes it possible to set deletion deadlines more consistently and implement them more easily from a technical standpoint.
Why Fire Suppression Plans Are Important for Businesses
An effective Fire Suppression Plan offers several advantages. It helps companies comply with legal requirements for data deletion, reduce risks associated with excessive data storage, and ensure data protection—Compliance to verify. At the same time, it can help clean up data sets, eliminate redundancies, and reduce IT costs.
Of particular importance is the Documentation. Pursuant to Article 5, paragraph 2 GDPR must Responsible persons be able to demonstrate that they comply with data protection principles. This includes defining retention periods, describing deletion processes, and establishing responsibilities.
A Fire Suppression Plan should therefore include the following points in particular:
- Data Types and Processing Systems
- Legal basis and purposes of the Processing
- statutory retention periods
- Deletion and Review Deadlines
- Extinguishing Classes and Extinguishing Rules
- Responsibilities
- Technical implementation of the Deletion
- Working with Backups and Archiving Systems
- Documentation Firefighting Operations
- Regular review and updating
Implement Fire Safety Obligations in Compliance with the Law Using a Fire Safety Plan
The obligation to Deletion The issue of personal data is not a new one, but it has gained prominence due to the GDPR but has become significantly more important in practical terms. Companies may personal data Don't store data indefinitely just because storage space is inexpensive or the data might be useful later on.
A structured Fire Suppression Plan to GDPR and DIN 66398 helps ensure the controlled management of data sets, the legally compliant implementation of data erasure obligations, and the demonstration of compliance with data protection principles. For data protection officers, IT-Responsible persons and Compliance-Teams is therefore a key tool in an effective data protection management system.
German 
English 
Italian 
French