Personal data should be kept only for as long as it is necessary for the purpose for which it was processed; once that purpose no longer exists, the data should be deleted, destroyed or anonymised. This principle is a direct reflection of the KVKK rule that data be retained "for the period stipulated in the relevant legislation or required for the purpose for which it is processed." Controllers registered with VERBİS are expected to prepare a Personal Data Retention and Disposal Policy. In this article we cover what elements the policy should contain, an example retention schedule and a practical, step-by-step disposal workflow.
What Is a Retention and Disposal Policy?
A retention and disposal policy is a document that sets out in writing which personal data an organisation keeps and for how long, by what method it will dispose of that data once the retention period expires, and how these processes will be managed. The policy is critical both for documenting accountability and for providing an operational roadmap.
Elements the Policy Should Contain
A well-structured retention and disposal policy should include at minimum the following sections:
- The purpose and scope of the policy
- Definitions (personal data, disposal, controller, etc.)
- Recording media (physical and electronic)
- The legal, technical and operational reasons requiring retention and disposal
- A retention-schedule table by data category
- Disposal methods and techniques
- The periodic disposal interval and responsible units
- The principles for updating the policy
What Does Disposal Mean? Three Methods
In KVKK terminology, "disposal" means putting data irreversibly out of processing use, and covers three methods:
- Deletion: rendering the data inaccessible and unusable in any way for the relevant users.
- Destruction: rendering the data inaccessible, irretrievable and unusable by anyone in any way (for example, physically destroying the storage media).
- Anonymisation: rendering the data such that it can in no way be associated with an identified or identifiable person, even by matching it with other data.
Example Retention Schedule
The table below is illustrative; each organisation should set its own periods according to its activities and the legislation it is subject to. Periods may arise from relevant sector-specific legislation (such as commercial and tax law).
| Data Category | Reason for Retention | Disposal Method |
|---|---|---|
| Employee personnel file | Labour and social-security law | Deletion / destruction |
| Invoices and financial records | Commercial and tax law | Destruction |
| Website visitor logs | Legitimate interest / security | Deletion |
| Marketing consent (withdrawn) | Purpose ends when consent is withdrawn | Deletion |
The periods in the table should be made concrete according to the legislation binding on you and your processing purpose. The general rule is that, once the purpose ends, the data is disposed of in the first periodic disposal cycle.
Periodic Disposal and a Step-by-Step Workflow
Data whose retention period has expired should be disposed of regularly in predefined periodic disposal cycles. The following workflow is a practical implementation suggestion:
- Update the inventory: keep your personal data processing inventory current and mark each category's retention period.
- Identify the expired data: in the periodic disposal cycle, list data whose retention period has ended.
- Check for exceptions: verify whether there is an ongoing legal dispute or a statutory retention obligation.
- Choose the appropriate method: decide on deletion, destruction or anonymisation according to the medium.
- Carry out and document the disposal: perform the disposal and record who disposed of which data, when and by what method.
- Keep the records: retain the disposal records for accountability.
Example Scenario
A software company evaluates CVs received for open positions. For unsuccessful applications, the company keeps the CVs in a talent pool for a limited period under legitimate interest.
When that period expires, the relevant CVs are identified in the periodic disposal cycle. Wanting to produce statistics on future applications, the HR team chooses to anonymise some data rather than delete it: name, contact and identifying fields are permanently removed, and only non-identifiable aggregate statistics (such as the number of applications and their distribution by position) are kept. Applications subject to an active legal dispute are, as an exception, excluded from disposal. All operations are recorded in a disposal record.
Frequently Asked Questions
For whom is a retention and disposal policy mandatory?
Controllers obliged to register with VERBİS are expected to prepare a retention and disposal policy. For organisations without a registration obligation, having such a policy is still a strong good practice.
Who sets the retention periods?
Periods arise primarily from relevant sector-specific legislation (such as commercial, tax, labour and social-security law). Where the legislation sets no explicit period, the controller should set a proportionate period appropriate to the processing purpose.
What is the difference between deletion and anonymisation?
Deletion makes the data inaccessible to the relevant users; anonymisation renders the data unable to be associated with a person in any way, taking it out of the scope of personal data and allowing statistical use.
Is it necessary to document disposal operations?
Yes. Recording who performed a disposal, when and by what method is a requirement of the accountability principle.
This content is for general information only and does not constitute legal advice.
To build your retention-schedule table and manage your periodic disposal processes with automated reminders, you can request a JUS. demo.