How do you set a GDPR-compliant document retention policy?

A retention policy means a written period for every document type, and a deletion that actually happens.

Răspuns scurt

You inventory the document types that contain personal data.
For each type you set a retention period and its basis: a legal obligation or a documented legitimate interest.
When the period expires, the document is deleted or anonymized automatically, not "whenever someone remembers".
Every deletion is recorded, so you can prove compliance with the storage-limitation principle.

Regulation (EU) 2016/679, Art. 5(1)(e) — storage limitation: personal data is kept only as long as necessary for the purpose.
Regulation (EU) 2016/679, Art. 17 — the right to erasure; it doesn't apply where retention is required by a legal obligation.
Law 82/1991: the 10 years for registers and supporting documents and the 50 years for payroll records apply over a deletion request.
OMFP Order 2634/2015: for some financial-accounting documents the period is 5 years.
Law 16/1996: the records retention schedule is the document where these periods are actually written down.

CVs of rejected candidates: a short period set by the company, often 6–12 months, with the candidate informed beforehand.
A former employee requests data deletion: their file can't be deleted in full, because the payroll record has a legal period of 50 years.
The building access log: a period of a few months, then automatic deletion, with no manual step.
A company with 300 document types narrows the list to 42 categories with distinct periods and automates the rest.

The policy exists on paper, but no actual deletion has ever taken place.
Every deletion request is accepted, including for documents with a mandatory legal period.
Backups still hold data that was already deleted from the main system.
No proof of deletion is kept, so compliance can't be demonstrated.
Periods are set "out of caution" at 30 years for everything, which violates the storage-limitation principle.

A retention period configured for each document type, with its basis noted alongside.
An alert before expiry, so deletion is checked by a person in charge.
Automatic deletion or anonymization on schedule, including for attached files.
The deletion register stays as proof for the supervisory authority.