GDPR: Securely storing, archiving, and destroying customer data

Which documents containing customer data require special protection, how long they may be stored, and why a filing safe for data media is insufficient.

3 min read

The General Data Protection Regulation (GDPR) came into effect on May 25, 2018. It contains fundamental changes regarding the collection, storage, and processing of personal data. Non-compliance can result in fines of up to 20 million euros or 4 percent of annual global turnover. Since then, the storage and security of customer-related data in particular must be organized more sensitively. This guide summarizes what you should consider when keeping data.

Paper

Storage of paper documents

Documents containing personal data should be destroyed as far as possible as soon as they are no longer strictly required. Tax-related documents such as invoices containing customer data are exempt from this: in accordance with § 147 of the German Fiscal Code (Abgabenordnung), they must be kept for ten years. Caution is also advised with paper documents such as contracts, employee data, material slips, and time sheets.

According to a Bitkom study, the majority of processes in small and medium-sized enterprises are paper-based. 20 percent of documents in all German businesses exist exclusively in paper form.

These paper documents must be demonstrably protected against access by unauthorized persons. To meet these requirements, storing sensitive data in a security safe is essential. Bremer Tresor offers you a multitude of document safes that feature certified burglary protection.

For the storage of documents that must be archived over a longer period, a fireproof document safe is recommended. This safe offers tested fire protection that reliably prevents the destruction of paper in the event of a fire due to flames, heat, smoke, or extinguishing water. The overview of fire protection classes shows which level is sufficient for what.

Destruction

Destruction of paper documents

Physical data, just like digital data, must be demonstrably and irretrievably destroyed in order to guarantee the protection of personal data.

i
Order pays offIf a customer requests the deletion of their data under the right to be forgotten, it helps greatly if all documents are sorted by customer name and can be found quickly. A suspension file system provides good organization for this.

Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

Art. 5 (1) (f) GDPR, Integrity and Confidentiality

In addition, there is the storage limitation according to Art. 5 (1) (e): Personal data may only be stored in an identifiable form for as long as is necessary for the purpose. The controller is responsible for compliance and must be able to demonstrate it.

Digital

Storage of digital documents

We recommend that you store all storage media in a safe once the work process is complete. In this way, data carriers can be easily kept in file cabinets to prevent access to sensitive data.

Another option is to store the data carriers in a data safe. This offers reliable protection for USB sticks, hard drives, data tapes, or CDs in the event of a fire.

!
A file safe is not enough for data carriersA certified file safe protects paper, but not electronic storage media. Only a certified data safe guarantees the fire-safe storage of electronic data. The test measures the rise in internal temperature: for paper (suffix P), it may rise by a maximum of 150 degrees, while for data carriers (suffix DIS) only by 30 degrees. Starting from an initial temperature of 20 degrees, this means a maximum of 170 degrees in a paper safe and a maximum of 50 degrees in a data safe. An overview of the values can be found under fire protection classes.

Unsure which safe is sufficient for your documents?

Whether paper files, data carriers, or both: we will assess your case and tell you the appropriate fire protection class along with suitable models.

View document safes View data safes
Related to this guide

Suitable safes

Document cabinet
Document cabinet50 products
Data vault
Data vault8 products
Fireproof safe
Fireproof safe66 products
Call Send a message

Frequently asked questions

How long must invoices containing customer data be kept?
Tax-related documents such as invoices must be kept for ten years in accordance with Section 147 of the Fiscal Code. Other documents containing personal data should be destroyed as soon as they are no longer strictly required.
Is a lockable filing cabinet sufficient?
It must be proven that paper documents are protected from access by unauthorized persons. A security safe with certified burglary protection is the secure way to achieve this. For documents that are archived over several years, tested fire protection must be added.
Can I store data carriers in a document safe?
A certified document safe protects paper, not electronic storage media. For USB sticks, hard drives, data tapes, and CDs, you need a data safe with tested fire protection for data media.
What does the GDPR require when destroying data?
Physical data, just like digital data, must be destroyed in a provable and irretrievable manner. According to the storage limitation in Article 5, personal data may only be stored in an identifiable form for as long as it is necessary for the purpose. The controller must be able to provide proof of this.
How do I prepare for a deletion request?
If a customer requests the deletion of their data, a filing system in which all documents are sorted by customer name and can be found quickly is helpful. A suspension file system provides good organization for this.