Operations & Administration (Control)
Data protection: deletion calendar, dry run and report
DlaAdministracjaOperator
Deletion requests, their records and the data held back because of retention obligations — with a deletion calendar, a dry run beforehand and a regular report to the data protection officer.
Po co#
In front of a supervisory authority two figures count: what is due today — and what is still there although it was due. The second is the finding a supervisory authority finds first.
Jak to działa#
Ścieżka kliknięćAdministrationDeletion
- 1Open the page “Data protection — deletions” under /admin/datenschutz. At the top the notice about overdue items, if there are any.
- 2Check the scope first: the link “Check the scope first” leads to “Deletion — dry run” (menu item “Deletion”). There enter the “Email of the data subject” and “Check scope” — nothing is deleted.
- 3The dry run shows per table the strategy (delete permanently, pseudonymise, follows along, check), the number of rows and a note — plus the external systems.
- 4Back on the data protection page: set up the “Report to the data protection officer” — “Interval in days” (1 to 365; 90 = quarterly), name and email of the data protection officer, then “Save” (Rys. 1).
Rys. 1 “Report to the data protection officer”: interval in days, name and email, the latest reports. - 5“Blocked, with deletion date” shows per data set category, action, due date and legal basis; “Deletion procedures” every request with date, status and an expandable deletion report (Rys. 2).
Rys. 2 “Blocked, with deletion date”: category, action, due date and legal basis.
Ustawienia i przełączniki#
Brak własnego przełącznika w katalogu — funkcja należy do swojego otoczenia.
- The interval of the report is deliberately not in the source code: without a setting the run produces no reports, and the page says so.
Delete, block, anonymise#
- Delete — where no obligation stands against it, data is deleted permanently.
- Block — where a retention obligation applies, the data set is blocked and gets a deletion date (Art. 17(3)(b) GDPR).
- Anonymise or pseudonymise — where connections must be preserved (such as statistics) without a person remaining identifiable.
Two surfaces, two steps#
The dry run shows what a deletion would touch without changing anything. The data protection page executes and writes the record. Whoever does not know this thinks one of the two is broken — that is why they refer to each other.
Who may do what#
- Data protection page: an organisation's administration (HR management or university administration) for its organisation, and the operator.
- Dry run: only the operator.
Wskazówki#
- Retention periods are calculated from the end of the year, as tax and commercial law require; the report is based on the result, not on the plan.
- Every report can be expanded; “no action required” or the number of open items is already in the row.
Powiązane funkcje#
- Document auditThe document file: who saw which document when and which documents have exceeded their retention period.
- Operation and data in the EUDatabase, files and server functions are in Frankfurt — as a hard rule in the code that an automated test checks on every change. Individual services such as speech output work in the USA; they are named.
- Audit log and audit evidence bundleWho did what when in an organisation's administration — and a package with all records for an auditor, as one file with a checksum per file.
Wiedza w tle
- Learning platforms and data protection: checking EU hostingWhat data an LMS processes, what the GDPR requires, what EU hosting really means and how to check AI services, data processing and deletion.
- Organising data protection training for employeesOrganising data protection training for staff: target groups, content per role, rhythm, comprehension checks and records that support GDPR accountability.
- GDPR data protection training: duty, content, frequencyWhere the duty to train staff in data protection comes from, what content belongs in it, how often to train and how to evidence it under Article 5(2) GDPR.