Retention period or deletion period – what is the difference?
The retention period is a lower limit: records must not be destroyed before it expires. The deletion period is an upper limit: after it, personal data may no longer be processed because it is no longer needed for the purpose.
In practice, the two are closely linked. The deletion period then follows the end of the retention obligation, plus a short time for technical implementation. Where there is no retention obligation, the purpose alone determines how long data may be kept.
Which periods commonly apply in Switzerland?
An overview of some common legal bases:
| Area | Period | Legal basis |
|---|---|---|
| Accounting records, vouchers, annual report and audit report | 10 years from the end of the financial year | Art. 958f CO |
| VAT records | until the absolute limitation of the tax claim (generally 10 years; real estate 20 years) | Art. 70 VAT Act |
| Contractual claims in general | 10-year limitation period | Art. 127 CO |
| Claims arising from employment | 5-year limitation period | Art. 128 no. 3 CO |
| Claims for personal injury | up to 20 years (absolute limitation period) | Art. 60 para. 1bis and Art. 128a CO |
| Patient records | regulated at cantonal level | cantonal health laws |
Limitation periods are not retention obligations. They can, however, be a reason to keep records in order to defend against claims. This overview does not replace a case-by-case assessment; industries such as insurance, banking and healthcare have additional regulations.
How does a retention period become a deletion rule?
A period can only be implemented once it is fully described:
- 1Determine the data type, for example contract data.
- 2Record the purpose and legal basis of retention.
- 3Define the period, such as ten years.
- 4Determine the starting point, such as the end of the contract.
- 5Define exceptions, such as ongoing litigation.
- 6Specify for each system how data is deleted, anonymised or archived.
An example: “Contract data is deleted in all systems ten years after the end of the contract, unless a deletion hold applies because of litigation.”
Why retention periods must not exist only on paper
A period in a spreadsheet does not delete any data. It only takes effect when the systems recognise which records are due and actually carry out the deletion. If a period changes, the change must reach all affected systems. And exceptions belong in one central place, not in individual emails.
Retention periods also need maintenance: laws and business models change. A review date for each period ensures that the retention schedule stays up to date.