What sets the period?
Three sources are weighed together: explicit periods in specific legislation (for example, the obligations in tax and commercial law to keep books and records), limitation periods (how long a document might be needed in a dispute), and whether the purpose of processing still exists.
Once the purpose has ended and no legal obligation to keep the data remains, it must be erased, destroyed or anonymised.
What does a retention and disposal policy cover?
Organisations that process personal data need this policy in writing, and it has to be workable.
- Which category of data is kept for how long
- Which event starts the clock (end of a contract, end of the relationship, etc.)
- Scheduled disposal dates and who is responsible
- How disposal is documented: minutes and records
The most common mistake
Writing the policy without building it into the system. If the policy says “5 years” but nothing tracks it, documents are in practice kept forever. What an audit asks for is not the existence of a policy but proof that it is applied.
What the system should take on
A document management system can carry this load: each document type is linked to a retention schedule, expired documents land on a disposal list, disposal goes through approval and is recorded with minutes. Access logs answer the question “who saw what, and when?”.
mindfile includes these flows as part of the product; disposal runs with approval steps and a full audit trail.
FREQUENTLY ASKED QUESTIONS
Do the same rules apply to paper archives?
Yes. KVKK makes no distinction by medium; personal data in a physical file is subject to the same principles. In a physical archive, disposal is usually carried out as destruction recorded in minutes.
Do I have to delete a document when its period ends?
If no other legal reason to keep it remains, yes: the obligation to erase, destroy or anonymise it applies. If there is a legitimate reason, such as an ongoing dispute, record it together with the justification.
