Retention, archiving and deletion

1. Regulatory Concept & Core Standards

This video focuses on how to apply retention criteria without confusing closure with erasure. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. A reporting case may contain data about the reporting person, people concerned and third parties. Data protection must accompany the whole lifecycle, from the form to archiving. This course addresses operational decisions. Legal bases and restrictions on rights require assessment of the specific processing.

A retention schedule must specify data category, applicable rule, starting event, duration and any legally permitted exceptions. Receipt, closure and communication of outcome are different events. Distinguish a statutory maximum from a minimum and an internal review date. Litigation does not automatically override a statutory maximum. Assess any separate lawful use for proceedings and the public-archive rules that actually apply.

Apply the following rule: In private activity, personal data in follow-up cases under the Act may not be processed longer than two years after the case is closed. This is a maximum; necessity may require earlier deletion. Public activity is subject to the specific rules on official documents and archives. Do not automatically apply private-sector erasure rules to a public authority or invent an extension because litigation is pending.

2. Practical Implementation & Procedure

Define information classes, the reference event, duration, review owner and final disposition. Before a scheduled deletion, check the applicable rule, necessity and any pending proceedings. Preserve material only where legally permitted or required; do not invent an extension to a statutory maximum. Include exported copies and archival media, with restricted access. Clearly irrelevant data follow their own deletion rule. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A private-sector file approaches an internal deletion date while related litigation is pending. The team first checks whether this is an internal target or the statutory maximum. A dispute does not automatically permit retention beyond two years after the follow-up case has closed. Any necessary use as evidence must be assessed under its own legal basis, purpose and applicable rules; the reporting file cannot simply be kept indefinitely. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does reaching the originally planned date permit automatic deletion of everything? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Check the event and rule that control the date. In private activity, two years after closure is a maximum under the Whistleblower Act, not a minimum or automatically extendable standard. Consider earlier deletion when data are no longer needed. Public archives and lawful use in other proceedings require separate assessment. Record the decision for originals, copies, attachments and access.

One mistake to avoid is: configuring a single deletion period without legally relevant exceptions.

Now apply the national rule to a second decision. The system deletes every case five years after receipt, regardless of the country and any pending proceedings. Is that appropriate?

No. Identify the local rule, starting event and any limits or extensions. A uniform schedule may delete records too early or retain them too long. Document the decision by category, include copies and define who reviews a suspension of deletion, rather than keeping everything indefinitely.