Deletion Concept Generator

The GDPR, through the storage limitation principle, requires that personal data is deleted as soon as it is no longer needed. What makes sense in theory often fails in practice on a simple question: who actually deletes what, when and with which method? Without a written deletion concept this stays a matter of chance - and chance is exactly the wrong thing in a data protection audit. The Generator gives you a clear structure.

At the heart of the tool is a library of typical data categories - from applicant data through customer master data and invoices to application documents and log data. Each category comes with pre-filled suggestions: legal basis, retention period, deletion method, deletion trigger and responsibility. You select the categories that apply to your business and adapt them instead of starting from scratch.

For each category you set how deletion happens: physical, digital or both. A paper folder goes into the shredder, a record is securely removed from the database, some documents both. The deletion trigger states what sets the period in motion - such as the end of a contract or the conclusion of an application. And the responsibility records who actually has to initiate the deletion.

If an important entry is missing or a period is implausible, the tool flags it with a note before you finish the concept. That way it does not only surface during the audit that a category stands there without a period or without a responsible party. Alongside the ready-made templates, you can create your own categories at any time that are not in the library.

Several views show your concept from different angles: the library for selecting, the concept view with all chosen categories, a timeline of the periods and a preview of the finished document. That way you keep the overview while assembling it and see how the result will look in the end. The finished concept can be printed or filed.

The Generator structures your entries and provides a solid basis, but makes no legally binding statement about which period or deletion method is correct in your specific case. Retention periods can overlap and depend on the individual case. Use the tool for the structure and documentation, and if in doubt have the concept reviewed by a data protection professional.