Destruction of Personal Data

Destruction of personal data is one of the three disposal methods under Article 7 of the KVKK: rendering data inaccessible, irretrievable and unusable by anyone in any way. It is more conclusive than erasure, where data is only made inaccessible to the relevant users.

Destruction Methods

The main methods listed in the Authority’s guidance on erasure, destruction and anonymisation are:

• Physical destruction: Physically destroying media such as disks, flash drives and optical discs by melting, incineration or pulverisation,
• Paper records: Shredding documents into small pieces so they cannot be read, or burning them,
• Overwriting: Writing random data over magnetic media at least seven times with special software so the old data cannot be read,
• Degaussing: Exposing magnetic media to a strong magnetic field.

When to Choose Destruction

Destruction should be preferred where recovery of data could cause serious harm, for example for special categories of personal data, when disposing of end-of-life devices and when destroying paper archives.

Destruction by a Supplier

If destruction is outsourced, the supplier is a data processor. The contract should set out the destruction method, confidentiality and a destruction record, and a destruction certificate should be obtained.

Records

All destruction operations must be recorded and the records kept for at least three years. Which data categories are destroyed and at what intervals is set in the retention and destruction policy.