Skip to content 
Löschkonzept
In brief
An erasure policy is a documented set of rules that defines which data a company erases, when, by whom and in what way. It links statutory retention periods with the obligation not to store personal data longer than necessary. For IT decommissioning, the erasure policy governs how data carriers from retired devices are erased or destroyed.
What belongs in an erasure policy?
A recognized point of reference is provided by the standard DIN 66398. Typical components are:
| Component | Contents |
|---|---|
| Data types | Which types of personal data exist, e.g. applications, customer data, logs |
| Erasure periods | When data is erased, derived from purpose and retention obligations |
| Responsibilities | Who initiates, carries out and monitors erasures |
| Method | How erasure is carried out in systems and on data carriers, including destruction |
| Documentation | How erasures are proven |
Erasure policy and decommissioning
Many erasure policies concentrate on databases and applications and forget the hardware. Yet decommissioned laptops, servers and smartphones often hold complete copies of this data. A good erasure policy therefore also specifies which methods apply to HDDs, SSDs and mobile devices and which proof is expected. What this looks like in practice is described in the guide Disposing of data carriers in GDPR-compliant fashion. The basis is the principle of Storage limitation from the GDPR. This entry does not replace legal advice.
Second IT erases data carriers with Blancco and issues a digitally signed erasure certificate for each device. This fits as proof in the documentation of an erasure policy.
Frequently asked questions about the erasure policy
Is an erasure policy mandatory?
The GDPR does not expressly mention the term. However, it requires that data not be stored longer than necessary and that this be demonstrable. An erasure policy is the usual way to do so.
What is the difference between an erasure policy and an erasure report?
The erasure policy sets the rules. The erasure report proves that a specific erasure actually took place.
Does the destruction of data carriers belong in the erasure policy?
Yes. For data carriers that cannot be erased, the policy should govern destruction, for example with a security level according to DIN 66399.
What is DIN 66398?
DIN 66398 was the German standard for the structure of erasure policies and was replaced in 2025 by DIN EN ISO/IEC 27555. Its system of data types and standard erasure periods continues to be used in practice. Neither of the two standards gives rise to a legal obligation to apply it.
Does an erasure policy also have to cover laptops and smartphones?
Yes, that makes sense. Many policies only describe databases and applications. Yet decommissioned devices often hold complete copies of the data. The policy should therefore define methods for HDDs, SSDs and mobile devices and state the expected proof.
The proof for your erasure policy: one certificate per device.
Send us your device list. You will receive your offer in 48 hours on average.