Skip to content 
DIN 66398
The GDPR requires that personal data not be stored longer than necessary. However, it does not say how a company should organize this. This is where DIN 66398 comes in: the standard describes how you build an erasure concept and derive erasure periods.
In brief
DIN 66398 is a German standard titled "Guideline for developing an erasure concept with derivation of erasure periods for personal data". It shows how companies divide their data into data categories, set periods and regulate responsibilities for erasure. For IT retirement, it provides the organizational framework that determines which data must be erased when.
What does DIN 66398 regulate?
DIN 66398 is a guideline, not a legal obligation. It was published in May 2016. The standard describes a way for a company to develop an Erasure concept . An erasure concept is a document that specifies for all types of personal data when and how they are erased. The basis is the principles of the GDPR, above all the Storage limitation according to Art. 5 GDPR and the right to erasure under Art. 17 GDPR.
Structure and key terms
| Term | Significance |
|---|---|
| Data type | Group of similar data with the same purpose, such as application documents or customer master data |
| Start point | Event from which a period runs, such as the end of a contract |
| Standard erasure period | Uniform period that applies to many data categories so that not every data category needs an individual period |
| Erasure class | Combination of start point and standard erasure period; data categories with the same erasure class are treated alike |
| Standard erasure period | Period after which data of a data category are normally erased |
| Erasure rule | Specific requirement on how and by whom data in a system are erased |
Erasure periods are derived from the purpose of processing and from statutory retention periods , for example from commercial and tax law. The standard recommends working with a few standard periods. This keeps the concept clear and workable.
Who is DIN 66398 relevant for?
The standard is aimed at all organizations that process personal data, and especially at data protection officers, IT management and specialist departments. It helps to meet the accountability obligation of the GDPR: Anyone with a documented erasure concept can show that data is not stored arbitrarily.
How to implement DIN 66398
- Record data categories, for example from the record of processing activities.
- Determine purpose, start point and retention obligations for each data category.
- Define a few standard erasure periods and assign the data categories to erasure classes.
- Formulate erasure rules for the individual systems and name those responsible.
- Document the implementation and review it regularly.
One point is often forgotten: data does not reside only in applications but also on devices. When laptops, servers or storage systems are retired, the data carriers must be completely erased or destroyed. The erasure concept should explicitly regulate this step. Which GDPR obligations count in the audit here is explained in our guide Disposing of data carriers under the GDPR.
Distinction from similar standards
DIN 66398 regulates which data is erased when. DIN 66399 regulates how data carriers are physically destroyed. The two complement each other but are often confused. Internationally, ISO/IEC 27555 provides a guideline on erasing personal data, which is now also available as DIN EN ISO/IEC 27555. Technical erasure methods for data carriers, by contrast, are described by standards such as NIST SP 800-88 or IEEE 2883.
At Second IT, retired data carriers are erased with Blancco, with a digitally signed erasure certificate per device. Data carriers that cannot be erased are destroyed in-house according to DIN 66399. You can file the certificates as evidence of the implementation of your erasure concept. More on data security in the processing chain.
Frequently asked questions about DIN 66398
Is DIN 66398 mandatory?
No. DIN 66398 is a voluntary guideline. However, under the GDPR it is mandatory not to store data longer than necessary and to be able to prove it. The standard is a recognized way to implement this obligation.
What is the difference between DIN 66398 and DIN 66399?
DIN 66398 describes the erasure concept, i.e. which data is erased when. DIN 66399 describes the physical destruction of data carriers with protection classes and security levels.
Does the retirement of hardware belong in the erasure concept?
Yes. Data also resides on hard drives, SSDs and smartphones. The erasure concept should specify that data carriers are erased or destroyed before they are handed over and how the evidence is filed.
What is an erasure class under DIN 66398?
An erasure class is the combination of start point and standard erasure period. Data categories with the same erasure class are treated alike. This way not every data category needs its own individual period, and the erasure concept stays clear.
What are erasure periods in the erasure concept derived from?
Erasure periods are derived from the purpose of processing and from statutory retention periods, for example from commercial and tax law. The standard recommends working with a few standard periods. This makes the concept workable.
Your erasure concept, implemented down to the last data carrier, with a certificate per device.
Send us your device list. You will receive your offer in 48 hours on average.