Why is proof of deletion needed?
Under the GDPR, an organisation must not only comply with the principles but also be able to demonstrate this (accountability, Art. 5 para. 2 GDPR). The FADP has no equivalent provision. But in Switzerland too, at the latest when internal audit or the regulator carries out an inspection, when a complaint is filed or after an erasure request, what counts is what can be proven.
What belongs in a deletion log?
A meaningful log answers what happened, when, where, why and at whose instigation:
- Deletion run or order, with identifier and time.
- Basis: expired retention period or erasure request.
- The affected systems.
- The result per system: deleted, anonymised, archived – or not deleted, with the reason.
- The number of affected records.
- Approvals and interventions with person, role and time.
- Exceptions such as deletion holds and objections.
What does not belong in it?
The deleted content itself – otherwise the log would be a copy of what was supposed to be deleted. And no more personal data than necessary: where proof is needed for a specific person, an internal identifier instead of the name is usually sufficient. Access to the log remains tightly restricted.
Why a spreadsheet is not enough
A spreadsheet or ticket shows the order, not the effect. It is maintained by hand, is often incomplete and can be changed retrospectively. Above all, it lacks the response from the systems: it does not show whether the data was actually deleted.
Reliable proof is generated automatically from the responses of the systems that performed the deletion, and is stored centrally and securely.
How long is a proof of deletion retained?
There is no statutory period for this. What matters is the purpose: the proof is needed for as long as audits, complaints or claims can be expected. This period belongs in the data deletion concept – and afterwards, the proof is deleted too.