The importance of data erasure for the protection of privacy and data protection

Why is deleting data important?

The data we share and store online can contain a wealth of personal information, from sensitive financial data to personal photos and contact information. If this data falls into the wrong hands or is misused, it can have serious consequences, including identity theft, fraud, and invasion of privacy. Deleting data provides a way to minimize these risks and ensure that the information is no longer accessible when it is no longer needed.

When does data need to be deleted?

Data erasure is governed by Art. 17 GDPR. Companies must delete personal data when the purpose for the prior collection or processing of the data no longer requires the continued storage of the data. The General Data Protection Regulation therefore links the duration of data retention directly to the purpose of the data processing.

This is known as the purpose limitation principle, which is a central cornerstone of data protection law (GDPR). It states that companies may only collect and process personal data for predetermined, explicit and legitimate purposes. In addition, data processing must be consistent with the original purpose.

The meaning for individuals

For individuals, data erasure is of great importance to protect their privacy. By regularly reviewing and deleting data that is no longer needed, they can ensure that sensitive information is not inadvertently disclosed. Individuals have the right under the General Data Protection Regulation to request that companies delete their personal data when it is no longer necessary for the purposes for which it was originally collected.

The importance for companies

The concept of erasure is particularly important for businesses, as they often hold large amounts of customer data and it is their responsibility to ensure that this data is adequately protected and erased when it is no longer needed. This can be achieved by implementing data erasure policies and procedures to ensure that personal data is deleted in accordance with data protection regulations.

Problems with deleting data with third-party providers (The SaaS problem)

With many third-party providers (so-called Software-as-a-Service "SaaS" tools), companies often have no control over the data being processed and therefore cannot ensure that the data has really been deleted. Agreements between the company and the third-party provider must include clear provisions governing the deletion of data. However, it can be difficult to ensure that these agreements are followed and that the data is actually deleted when required.

As a company, however, the responsibility to delete the data falls on you. You may need to ask the third-party vendor to delete data that they have already stored. On the other hand, a data compliant solution is offered by Open Source Tools. With Glasskube, you'll have full control over sensitive data in no time. You no longer have to rely on external SaaS service providers, but simply select the desired open source tool and we take care of the secure operation in your private infrastructure. You alone decide where your data is stored, which data is processed and what happens to it. This way you can easily meet all legal requirements when processing personal data.

The data erasure concept in detail

Compliance with the General Data Protection Regulation (GDPR) requires clear specifications for deleting personal data as soon as it is no longer needed. In such cases, for example when the data have fulfilled their purpose of use or the data subject requests deletion, specific measures must be taken. An internal deletion concept defines who within the company is responsible for deleting specific data (such as customer data or employee data), where this data is stored and how the deletion process should proceed. Such a concept is of great importance to avoid mistakes and prevent possible consequences under the GDPR.

It is advisable to design the erasure concept according to the size of your company, as the scope depends on the amount of personal data you process. Regardless, it is advisable to create a comprehensive list of deletion deadlines to be ready for any deletion requests.

The deletion concept includes several aspects that should be considered in order to securely and effectively delete data. In addition, it is important to understand that simply deleting files from a device or cloud storage platform is not enough to permanently remove them. Deleted data can often be recovered if appropriate measures are not taken.

What must a deletion concept contain?

An effective deletion concept should contain the following aspects:

Determination of deletion guidelines: The deletion concept should contain clear guidelines on when and how data should be deleted. It is important that these policies comply with applicable data protection regulations and take into account the specific requirements of the organization.

Identification and classification of sensitive data: For the deletion policy, sensitive data should be identified and appropriately classified to ensure that it is appropriately protected and deleted. This includes personal data, confidential company information, or other sensitive information that requires protection.

Determination of retention periods: The deletion policy should include clear guidelines for the retention of data. It is important to consider legal requirements and business needs to ensure that data is retained for the required time and then properly deleted. It must be specified exactly when the time period begins. For example, applicant:internal data may be deleted when the application process is complete. Therefore, carefully consider when it is appropriate or permissible to destroy records.

Security Measures for Deletion: The deletion policy should describe specific security measures that must be applied to ensure that data is completely and irrevocably deleted. These may include overwriting storage areas, using encryption techniques, or using special erasure software.

Log and prove deletion events: It is important to log all deletion events and make them verifiable. The deletion policy should specify how deletion operations will be documented and monitored to ensure that they have been properly performed.

Training and Awareness: The deletion policy should include training and awareness activities for employees to ensure they understand the importance of data deletion and comply with established policies and procedures.

Review and Update: The deletion policy should be reviewed periodically and updated as needed to ensure it meets current privacy regulations and organizational requirements.

Want to take back control of your own data and process, store and delete data in a GDPR compliant and secure manner? Contact us and take advantage of open source with Glasskube today.