Personal Data Retention and Destruction Policy

Also known as: Retention Periods, Periodic Destruction, Data Retention Policy, Saklama ve İmha Politikası

In short

A policy setting out how long the controller keeps personal data, by which method it is disposed of at the end of that period and at what intervals periodic destruction takes place; mandatory for those required to register with VERBİS.

The personal data retention and destruction policy, governed by the Regulation on Erasure, Destruction or Anonymisation of Personal Data, sets out the controller’s retention and disposal processes. Controllers required to register with VERBİS must prepare this policy.

Content of the Policy

Purpose and scope of the policy,
Environments where data is stored (servers, cloud services, paper archives),
Legal and technical reasons for retention and disposal,
Technical and organisational measures taken,
Disposal methods: erasure, destruction and anonymisation,
Titles and responsibilities of those involved,
A table of retention and destruction periods by data category,
Periodic destruction intervals.

Setting Retention Periods

Retention periods are first set according to statutory periods: for example ten years for commercial books and records, and limitation periods after termination for employee files. Where there is no statutory period, the period required by the processing purpose and limitation periods for potential disputes are considered. Periods must be consistent with the personal data inventory and VERBİS registration.

Periodic Destruction

The controller disposes of data whose retention period has expired within the periodic destruction intervals set in the policy; the interval may not exceed six months. All erasure, destruction and anonymisation operations must be recorded and the records kept for at least three years, subject to other legal obligations.

In Practice

The policy must not remain on paper. In Board investigations, whether the periods in the policy are actually applied in systems and whether destruction records are kept is questioned.

Frequently Asked Questions

How long should we keep data?

For as long as legislation requires, such as retention periods under employment and tax law; otherwise for as long as the processing purpose requires. The period for each data category should be set in the personal data inventory and the retention and destruction policy.

We are not required to register with VERBİS; do we need a policy?

It is not legally mandatory. But since the obligation to dispose of data whose retention period has expired applies to everyone, a policy showing how this obligation is met is useful for every company.

← Glossary A–Z