Erasure concept for customer and lead data: periods, holds and evidence

An erasure concept for customer and lead data should neither destroy every record immediately nor keep all information indefinitely. The key questions are which purpose still exists, which period follows from law or contract and whether a specific claim requires continued retention. Organisations therefore need a clear distinction between erasure, restricted retention and a documented legal hold.

This article explains how prospects, customers, enquiries, contracts and evidence can be organised in a practical erasure concept. It focuses on purpose expiry, statutory retention, objections, pending disputes and evidence that an erasure process was actually completed.

Article 5(1)(e) GDPR requires storage limitation. Personal data should remain identifiable only for as long as necessary for the purposes of processing. This is not one universal deadline. A prospect who asked only for an offer is assessed differently from a customer with an active contract, an unpaid invoice or a specific damages claim.

An erasure concept turns that principle into responsibilities and procedures. It maps categories of data, purposes, systems, trigger dates, exceptions and the technical erasure path. The central question is not “How long do we keep customers?”, but “Which specific information is still needed, for what reason and until when?”

The concept should also distinguish erasure, anonymisation and restriction. Anonymisation may be appropriate where only statistics are needed. Restriction limits further use where records must be retained for a legal obligation or the establishment, exercise or defence of legal claims.

For leads, start with the actual reason for the contact. What was requested, what information was needed and is the communication still open? Once an enquiry has been dealt with, the complete contact history should not remain indefinitely in a sales system merely because a future opportunity is possible.

Further contact requires its own lawful purpose and legal basis. The fact that someone once requested an offer does not answer that question for every later campaign. A withdrawal or objection must be reflected in every system in which marketing is carried out.

A staged approach is often practical: open enquiry, closed enquiry with a short follow-up period, documented consent for a defined communication purpose and a restricted record after an objection. Each stage should have its own fields, access rules and next review date.

The end of a contract does not end every processing activity. Contracts, invoices, payment records and documents relating to performance may be subject to statutory duties. Sections 132 BAO and 212 UGB generally require the records covered by those provisions to be retained for seven years. The classification of the specific document remains decisive.

Keeping an invoice does not automatically justify open use of the entire customer file. Accounting records may remain in a protected archive, while sales notes, conversation details or unnecessary customer-service copies are erased. Access and purpose must match the information that is retained.

A sound erasure run therefore checks document type, legal ground, period and system, not only the customer name. If the same data exist in a CRM, ticketing system, file share, email archive and backup, the concept must cover the full lifecycle. Otherwise erasure is visible only in the lead system.

Article 17 GDPR does not make the right to erasure unlimited. Continued retention may be necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims. Article 18 GDPR provides for restriction in certain situations. This does not mean that the entire customer record can remain untouched without a defined scope.

A legal hold should name the reason, the affected records, the responsible person and the next review date. It should also state which uses remain permissible. A dispute about an invoice may require that invoice and the relevant communication, but not every old marketing note from an unrelated context.

When the claim or proceedings end, the hold must be reviewed actively. Otherwise exceptions become permanent archives. The erasure concept therefore needs a feedback path from legal, customer service and the business unit into the privacy process.

When customer and lead data are collected, organisations should state the planned retention period or the criteria used to determine it. The information in the privacy notice and the operational erasure concept should match. Phrases such as “as long as necessary” are not enough where the organisation applies concrete periods internally.

Data subjects may ask about the planned retention period and may request erasure under Article 17 GDPR where the conditions are met. The overview of data subject rights and access provides a structured starting point. The response should explain whether erasure occurred and which records remain restricted because of a legal duty or claim.

For direct marketing, objections require particular care. Article 21(2) GDPR gives data subjects the right to object at any time to processing for direct marketing. That objection must work across connected marketing tools and not only in the main CRM.

The erasure concept should identify the leading system, all relevant copies and the route by which an erasure request is propagated. This may include CRM, marketing platform, support, document storage, mobile devices and processors. Backups require a separate rule: they should not become a convenient permanent archive, but they may be handled through controlled overwrite cycles where access in the meantime is effectively restricted.

An erasure log does not need to reproduce the entire deleted communication. It should make clear which record, purpose, decision, date and process were involved. The documentation itself should not contain more personal data than necessary to prove that the process was performed.

For processors, the contract should cover erasure and return, subprocessors and evidence. The overview of processing and service providers helps with roles and controls. The page on privacy governance is relevant for responsibilities and access separation.

One period for every record: Customer data, invoices, open enquiries and marketing lists are forced into one common deadline. That ignores purpose limitation.

Seven years as a blanket ground: The periods in sections 132 BAO and 212 UGB concern the records covered by those provisions. They cannot be transferred automatically to every CRM note.

The legal hold never ends: A claim or dispute is recorded, but nobody checks whether the reason has ended. Every hold needs a reviewable endpoint.

Only the leading system is erased: Exports, support tools, marketing platforms and accessible copies remain. The concept must reflect real data flows.

No evidence of the erasure run: Without date, responsibility and outcome, it is difficult to explain later why data remain or are no longer available.

Start with a manageable data matrix. Record the category, purpose, systems, recipients, trigger date, retention ground, access group and erasure path. Then map common situations: unsuccessful lead, completed advice, active contract, paid invoice, objection, refund request and litigation.

Next, check whether the technology follows the concept. A process is reliable only if erasure requests reach the relevant applications, restrictions survive synchronisation and employees know who can end an exception. Documentation should allow a later review without creating a new full archive.

The privacy governance section should assign responsibility for periods, exceptions and evidence. This turns the erasure concept into part of daily organisation rather than a document kept in a folder.

For customer and lead data, legal basis, purpose, system and actual process must match. We can review which records should be erased, anonymised or placed under a limited legal hold, which documents are subject to statutory retention and how the erasure process can be evidenced. Contact us with your existing concept, data matrix or a specific erasure request so that the next steps can be defined clearly.