German state of Saxony-Anhalt regulator issues GDPR data deletion guide, clarifying that the recycle bin does not count as deletion

Saxony-Anhalt’s data protection commissioner published “GDPR Personal Data Deletion Policy: A Guide for Small Businesses,” an 18-page guide with 13 sections explaining how small businesses can establish a data deletion policy. The guide turns deletion obligations into an operational checklist covering records of processing activities, an inventory of storage locations, a sample deletion schedule with specific retention periods, DIN 66399 security levels for shredding, backup handling, and an eight-step process for deletion requests. It also makes clear that moving files to the operating system’s recycle bin does not meet deletion requirements.