Document handling under GDPR comes down to three questions: Where is the document stored, who can open it, and when is it deleted? The rules apply to every document containing personal data, whether it is a contract in an HR system, a spreadsheet on the desktop or a printout in a drawer.
Most companies have the big systems under control. The problems arise in everything loose: the copy saved locally “just in case”, the attachment in an old email thread, the folder from a project that ended four years ago. This guide follows a document from the moment it is created until it disappears.
When the document is created
The first choice is made before anything is saved: Which information needs to be included at all? The data minimisation principle in Article 5 of the GDPR says you may only process the information that is necessary for the purpose.
In practice this means:
- Do not create a spreadsheet with national ID numbers if the employee number is enough.
- Do not copy the whole customer list into a new document when you only need five names.
- Do not write assessments of people in free-text fields and meeting notes unless it is necessary and factual. The person the note is about can request access and see it.
Where the document should be stored
Use the systems the company has chosen for the purpose. It sounds obvious, but this is where most deviations occur.
The desktop, the Downloads folder and private cloud services are the typical hiding places. Files there are outside the company’s backup, access management and deletion routines, and nobody else knows they exist. When a customer or former employee asks for access to or deletion of their information, the company cannot comply if half of it is on local drives.
A simple rule for employees: save in one place, and link to the document instead of making copies.
Naming helps too. A file called “Applications_marketing_coordinator_2026” can be found and deleted when the retention period expires. A file called “Combined_v3_FINAL” stays where it is.
Who may see it
Access should follow the task. Being employed by the company does not in itself give the right to see colleagues’ sickness absence or customers’ finances.
For employees, this means two things. They should share with named people instead of with “everyone in the organisation” or “anyone with the link”. And they should not open documents they have no work-related need to see, even if the system allows it. Look-ups without a work-related reason are a violation for which the individual employee can be held personally responsible, and the Danish Data Protection Agency has separate guidance on fines for individuals.
When the document is shared
Sharing is where most things go wrong. According to the Danish Data Protection Agency’s guide to the 10 typical breaches, most reported personal data breaches concern information unintentionally shared with the wrong recipients.
Three habits remove most of the risk:
Share a link instead of a file. A link can be withdrawn, and access can be changed. An attachment is out of your hands the moment the email is sent.
Check the recipient and the content. Open the attachment before you send it. Is it the right version? Are there hidden tabs or columns in the spreadsheet with information the recipient should not have?
Use secure transmission for confidential and sensitive information. National ID numbers, health information and similar data must not be sent in an ordinary, unencrypted email. Use the solution the company has chosen, such as secure email or a portal. We go into more depth in the article on what employees may write and send by email under GDPR.
If you share with an external supplier who will process the information on your behalf, there must be a data processing agreement. If you are unsure whether one exists, ask before you send.
When the document should be deleted
Personal data may only be kept for as long as there is a purpose for it. The GDPR does not set the periods itself, so the company has to decide them and be able to justify them. Some follow from other legislation, others from practice. The examples below are from Denmark:
| Document type | Typical period | Background |
|---|---|---|
| Accounting records | 5 years after the end of the financial year | The Danish Bookkeeping Act |
| Applications from candidates who were not hired | Often 6 months | Common practice. The Danish Data Protection Agency has accepted up to 3 years when the company can justify the need |
| Personnel files after employment ends | Often 5 years | Common practice with reference to the five-year limitation period for claims from employment |
| Customer information without an active customer relationship | Set by the company | Must be justifiable by the purpose |
The periods in the table are indicative. Your own should be set out in the company’s deletion policy.
A ruling from 2025 shows that deletion is taken seriously. In September 2025, the Danish High Court fined a retail chain DKK 1.5 million for keeping information about former customers in an older IT system for longer than there were grounds for. The Danish Chamber of Commerce has published a review of the ruling (in Danish).
For employees, deletion is mostly about the places automatic routines do not reach: the inbox, the Downloads folder, the desktop, the recycle bin and notes on the phone. A fixed clean-up a couple of times a year, ideally as a shared task in the department, is the most realistic solution.
Paper counts too
Printouts containing personal data are covered by the same rules. Collect them from the printer immediately, do not leave them on the desk overnight, and use the shredder or the locked container. Paper in the ordinary waste bin has not been deleted.
What about the documentation requirement?
People who search for documentation and GDPR are often looking for a different requirement. The accountability principle in Article 5(2) means the company must be able to demonstrate that it complies with the rules. That is done through the record of processing activities, risk assessments, data processing agreements and documentation that employees have been trained, among other things.
The two are connected. Without clear rules for where documents are stored and when they are deleted, the record cannot match reality.
From guideline to habit
A ten-page document policy is rarely read. Employees need to see the rules applied to the documents they work with themselves: the caseworker’s file, the salesperson’s quote, the HR partner’s personnel file.
That is the starting point for our GDPR training. The content is developed together with specialists in data protection law, and the scenarios can be adapted to your own working day, so employees practise situations they know. In the EDC case you can see how the course was made in several versions for employees with different roles and levels of knowledge. Read our overview of GDPR rules for employees as well.
