A data retention and disposal policy is the document that sets out how long each category of personal data is kept, on what grounds and where, and how it is deleted, destroyed or anonymised once that period ends. It is mandatory for data controllers obliged to register with VERBIS, but it only delivers value once your systems actually apply it.
Key takeaways
- A retention and disposal policy is mandatory under the 2017 erasure regulation for data controllers obliged to register with the Data Controllers' Registry (VERBIS).
- In practice the policy has nine headings: scope, recording media, responsibilities, measures, grounds, disposal techniques, retention schedule, periodic disposal and revisions.
- Periodic disposal runs at least every six months; every disposal operation is recorded and those records are kept for at least three years.
- Deletion, destruction and anonymisation are different methods; anonymised data is no longer personal data and can still be used for statistics.
- According to the KVKK 2025 Annual Activity Report, the Board fined 876 data controllers, 594 of them over VERBIS registration and notification duties.
Why does "keep everything, just in case" breach KVKK?
In many companies personal data is never deleted; it simply accumulates. CVs from applicants five years ago sit in a mailbox, copies of former employees' ID cards fill an archive cabinet and years of access control logs remain on a server. The justification is almost always the same: "We might need it one day." Which periods apply to personnel files is covered separately in employee personal data under KVKK.
Türkiye's Personal Data Protection Law (KVKK, Law No. 6698) does not accept "just in case" as a reason to keep data. Article 4 requires personal data to be kept only for the period set by the relevant legislation or needed for the purpose of processing, and Article 7 requires it to be erased, destroyed or anonymised, on the controller's own initiative or at the data subject's request, once the grounds for processing no longer apply.
The detail sits in the Regulation on the Erasure, Destruction or Anonymisation of Personal Data, published in the Official Gazette on 28 October 2017. Under that regulation, data controllers obliged to register with the Data Controllers' Registry (VERBIS) must prepare a retention and disposal policy consistent with their personal data inventory. As of 2026 the obligation remains in force; it is the local counterpart of the GDPR's storage limitation principle, with more prescriptive paperwork.
What does keeping personal data too long cost?
Every personal data record kept longer than necessary carries two risks: data subject complaints and data breaches.
Complaint volumes are rising. According to the KVKK 2025 Annual Activity Report, the Authority received 12,512 complaints and reports in 2025, and the Board fined 876 data controllers; 594 of those fines related to registration and notification duties with the Data Controllers' Registry. "I asked for my data to be deleted and it wasn't" is one of the easiest complaints to substantiate.
On the breach side the logic is simple: data you no longer hold cannot be stolen. According to the Microsoft Digital Defense Report 2025, attackers sought to steal data in 80% of the incidents Microsoft's teams investigated. The IBM Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million.
The ID and bank details of 300 people who left five years ago directly increase the number of people affected, the 72-hour breach notification workload and the reputational damage. Only 37% of breached organisations say they encrypt sensitive data both at rest and in transit (IBM 2026 press release), and old archives are often left outside that protection.
What must a data retention and disposal policy contain?
The regulation lists the minimum content of a retention and disposal policy. In practice the policy is organised under these nine headings:
- Purpose and scope. Which legal entities, sites and groups of data subjects it covers.
- Recording media. Every place the data lives: ERP, payroll, email, file servers, cloud storage, time and attendance, IP camera recorders and paper archives. If cloud storage sits abroad, the rules on cross-border data transfer apply as well.
- Responsibilities. Job titles, departments and duties of everyone involved in retention and disposal.
- Technical and organisational measures. How data is stored securely and protected against unlawful access.
- Grounds for retention. Legal (periods set by statute), technical or other reasons for keeping data. For internet access logs, for example, the period is set by Law 5651 log retention rules.
- Disposal techniques. Deletion, destruction or anonymisation for each medium.
- Retention and disposal schedule. Retention period and disposal timing per process and data category. For an example of tracking records with statutory periods in a system, see digital tracking of OHS training records.
- Periodic disposal interval. Under the regulation, periodic disposal takes place at intervals of no more than six months.
- Revisions. The date and content of changes to the policy.
What is the difference between deletion, destruction and anonymisation?
The regulation defines three methods for disposing of personal data. The right choice depends on the medium the data sits on and on whether the data will still be used as statistics after disposal.
| Method | What it means | Typical example |
|---|---|---|
| Deletion | Making data inaccessible and unusable in any way for the relevant users | Removing a database record, permanently revoking access |
| Destruction | Making data inaccessible, irretrievable and unusable by anyone | Shredding paper, physically destroying a disk |
| Anonymisation | Making data impossible to link to an identified or identifiable person, even when combined with other data | Stripping identities from access logs and keeping only aggregate counts |
A sample retention schedule
Retention periods depend on your business; the rows below only illustrate the method and should be confirmed with your legal adviser. For a wider list by document type, see our table of company document retention periods. Why drafting the policy needs legal and technical expertise together is covered in choosing a data protection consultant.
| Data / document | Ground for retention | Period |
|---|---|---|
| Commercial books and records | Turkish Commercial Code, Art. 82 | 10 years |
| Tax records and documents | Tax Procedure Law, Art. 253 | 5 years (from the following calendar year) |
| Employee personnel file | Potential claims arising from employment, general limitation period | A period set by the company after employment ends |
| CVs of unsuccessful applicants | Assessing the application | A short, clearly stated period |
| Access control and attendance logs | Security and timekeeping | Limited to payroll and potential dispute periods |
| CCTV footage | Physical security | Short, limited to the purpose |
How do you put a retention and disposal policy into practice in your systems?
Writing a retention and disposal policy is the easy part; the hard part is making the periods in the document actually run in your software. These six steps take the policy from paper into your systems:
- Give every system an owner. "Who deletes the data in this table?" should have a named answer.
- Build retention periods into software. In document management, email and access control systems, expired records should move to a disposal list or be anonymised automatically. We cover email in email archiving and data protection and documents in our paperless office guide.
- Remember version history. Old versions and recycle-bin copies of a deleted document are still data; our article on document version control touches on this.
- Include backups in the policy. Write down how long data deleted from live systems survives in backups; our guide to ransomware and 3-2-1 backups helps structure backup retention.
- Record every disposal. Under the regulation, deletion, destruction and anonymisation operations are recorded, and those records are kept for at least three years, other legal obligations aside.
- Set a deadline for data subject requests. When someone asks for their data to be deleted, the request must be concluded within 30 days at the latest; the workflow is explained in handling data subject requests.
A point that is often missed is that disposal is not only an IT job. Paper personnel files, old laptops and decommissioned disks are recording media too. Methods such as shredding, physical disk destruction or secure erasure software should be written into the policy for each medium, and a disposal certificate should be obtained whenever an outside firm does the work. Backup retention cycles and the secure disposal of old devices are also part of basic security hygiene; we list them in our SME cyber security checklist.
The periods in your retention and disposal policy should match the maximum retention periods declared in VERBIS; see our VERBIS registration guide and, for the full picture, our KVKK compliance roadmap.
How does Digital Bridge build retention and disposal rules into systems?
In its data protection compliance consultancy, Digital Bridge derives the retention and disposal policy from the personal data inventory and then builds it into software. Because the same team develops our software and hardware, we can define a retention rule both in the document and in the code.
- We build retention periods and disposal lists per document type directly into document management system projects.
- We design retention and access rules for staff data in HR, payroll and personnel management software.
- We set up structures that turn person-level data into anonymous statistics for reporting as part of data warehouse projects.
- We clarify duplicate personal records and data ownership across systems through data governance and quality work.
- Where an organisation wants a ready-made product for its file archive, we use SmartFiles business file management: a folder can carry a retention period of 1 to 30 years, expired documents are not deleted automatically but listed for the person responsible, and a document under legal hold cannot be moved to the bin or permanently deleted. The organisation's administrator sets how long items stay in the bin (30 days by default) and how many versions are kept per document (up to 10). To buy SmartFiles.com.tr, use the Smart360 purchase page.
For custom software projects we do not sell off-the-shelf packages; after a needs analysis we provide a written proposal setting out scope, phases and cost.
How does SmartPass handle retention and disposal of access records?
Access control and attendance logs show where every employee was, every day, which makes them one of the most sensitive rows in any retention schedule. SmartPass, developed by Digital Bridge, brings card access control, time and attendance, visitor management and canteen management into one panel. These are its main data protection features for access records:
- The organisation chooses the retention period. Access log retention is set anywhere between 30 days and the upper limit of the organisation's plan.
- Expired records are stripped of personal links. Fields that link a record to a person are deleted automatically every day; leavers' names, contact details and photos are deleted too, while counts and reports are kept.
- Card numbers are not stored. The number is turned into a one-way hash on the device with an organisation-specific key; the database holds only the hash and the last four digits.
- Audit log and record chain. Every change is logged with its previous and new values, and access and audit records are linked by a hash chain, so deletion or tampering is detected.
- Separate database and granular permissions. Each organisation's data sits in its own database; there are 43 separate panel permissions, and the person list and audit log reports need permissions of their own.
SmartPass is not sold online; it is priced according to the number of access points, the number of people and the hardware required. To buy SmartPass, simply fill in the SmartPass request form. For the attendance side of SmartPass, see our time and attendance guide; for biometric readers, see biometric attendance and data protection.
Next step: test your retention policy on a single system
The quickest way to test a retention and disposal policy is to start with a single system: pick the application that holds the most personal data and find the date of its oldest record. If you have no written reason for keeping it, your policy has not yet reached your systems. Share what you find through our contact page and we will draw up your retention schedule together and build the disposal rules into your software. For the other compliance steps, see our Cyber Security & Compliance guide.