Skip to content 
Regellöschfrist
In brief
The standard erasure period is the period after which a certain type of personal data is normally erased, counted from a defined starting point such as the end of a contract. The term comes from the DIN 66398 standard for developing erasure policies. Standard erasure periods put the GDPR principle of storage limitation into practice, also for data on devices that are decommissioned.
How a standard erasure period is set
One Erasure concept assigns a period to each type of data. This requires three building blocks:
| Component | Example |
|---|---|
| Data type | Application documents of rejected applicants |
| Start point | Receipt of the rejection |
| Period | a few months, set with possible legal claims in mind |
The standard erasure period applies to the normal case. If special reasons exist, such as ongoing litigation, erasure is suspended in the individual case. Statutory retention periods from commercial and tax law often determine the minimum duration. More on this in the entry Retention period. This entry does not replace legal advice.
DIN 66398 was replaced in 2025 by DIN EN ISO/IEC 27555, which describes guidelines for the erasure of personal data at the international level. The term standard erasure period remains in common use in practice.
Standard erasure periods and decommissioned IT
Data resides not only in databases but also on notebooks, servers, backup tapes and smartphones. At the latest at decommissioning, these copies must disappear, otherwise they undermine every period. Erasing the entire data carrier with a record per serial number closes this gap. How to do this in a GDPR-compliant way is shown in our guide Disposing of data carriers in GDPR-compliant fashion. Second IT erases with Blancco and issues a digitally signed erasure certificate for every device.
Frequently asked questions about the standard erasure period
What is the difference between a standard erasure period and a retention period?
The retention period prescribes how long data must be kept at a minimum. The standard erasure period sets when it is normally erased afterward.
Does the GDPR prescribe specific erasure periods?
No. It requires that data be stored only as long as necessary for the purpose. The company itself sets specific periods, usually in an erasure policy.
Do erasure periods also apply to backups?
Yes. Backups are often erased through their own rotation cycles. Decommissioned backup media must be verifiably erased or destroyed.
Does DIN 66398 still apply to erasure periods under the GDPR?
DIN 66398 was replaced in 2025 by DIN EN ISO/IEC 27555. This standard describes guidelines for the erasure of personal data at the international level. The term standard erasure period remains in common use in practice.
What happens to the erasure period during ongoing litigation?
The standard erasure period applies to the normal case. If special reasons exist, such as ongoing litigation, erasure is suspended in the individual case. Statutory retention periods also often determine the minimum duration.
Erase data on old devices on time and verifiably.
Send us your device list. You will receive your offer in 48 hours on average.