Перейти до вмісту
Спробувати

Operations & Administration (Control)

Data protection: deletion calendar, dry run and report

ДляАдміністраціяОператор

Deletion requests, their records and the data held back because of retention obligations — with a deletion calendar, a dry run beforehand and a regular report to the data protection officer.

Навіщо#

In front of a supervisory authority two figures count: what is due today — and what is still there although it was due. The second is the finding a supervisory authority finds first.

Як це працює#

Маршрут кліківAdministrationDeletion

  1. 1Open the page “Data protection — deletions” under /admin/datenschutz. At the top the notice about overdue items, if there are any.
  2. 2Check the scope first: the link “Check the scope first” leads to “Deletion — dry run” (menu item “Deletion”). There enter the “Email of the data subject” and “Check scope” — nothing is deleted.
  3. 3The dry run shows per table the strategy (delete permanently, pseudonymise, follows along, check), the number of rows and a note — plus the external systems.
  4. 4Back on the data protection page: set up the “Report to the data protection officer” — “Interval in days” (1 to 365; 90 = quarterly), name and email of the data protection officer, then “Save” (Рис. 1).
    Рис. 1 “Report to the data protection officer”: interval in days, name and email, the latest reports.
    “Report to the data protection officer”: interval in days, name and email, the latest reports.

    Рис. 1 “Report to the data protection officer”: interval in days, name and email, the latest reports.

  5. 5“Blocked, with deletion date” shows per data set category, action, due date and legal basis; “Deletion procedures” every request with date, status and an expandable deletion report (Рис. 2).
    Рис. 2 “Blocked, with deletion date”: category, action, due date and legal basis.
    “Blocked, with deletion date”: category, action, due date and legal basis.

    Рис. 2 “Blocked, with deletion date”: category, action, due date and legal basis.

Налаштування та перемикачі#

Власного перемикача в каталозі немає — функція належить до свого оточення.

  • The interval of the report is deliberately not in the source code: without a setting the run produces no reports, and the page says so.

Delete, block, anonymise#

  • Delete — where no obligation stands against it, data is deleted permanently.
  • Block — where a retention obligation applies, the data set is blocked and gets a deletion date (Art. 17(3)(b) GDPR).
  • Anonymise or pseudonymise — where connections must be preserved (such as statistics) without a person remaining identifiable.

Two surfaces, two steps#

The dry run shows what a deletion would touch without changing anything. The data protection page executes and writes the record. Whoever does not know this thinks one of the two is broken — that is why they refer to each other.

Who may do what#

  • Data protection page: an organisation's administration (HR management or university administration) for its organisation, and the operator.
  • Dry run: only the operator.

Поради#

  • Retention periods are calculated from the end of the year, as tax and commercial law require; the report is based on the result, not on the plan.
  • Every report can be expanded; “no action required” or the number of open items is already in the row.

Пов’язані функції#

Довідкові знання