Data Protection: When Must Data Be Deleted?
Personal data must be deleted according to Art. 17 GDPR as soon as the purpose ceases to exist, unless statutory retention obligations under the HGB (German Commercial Code) or AO (German Fiscal Code) apply. Companies require a structured deletion concept that legally soundly considers and practically implements deadlines, legitimate interests, and documentation obligations.