GDPR Erasure vs Calibration Records: What to Keep

The email reaches the quality office on a Tuesday. A technician who left eighteen months ago is asking the company to erase all of his personal data under Article 17 GDPR. It is a short, polite note and it is entirely within his rights. His initials and his sign-off also sit on roughly ten years of as-found and as-left records, on the thread gauges that released production lots, and on the torque tools behind a PPAP your biggest customer still keeps on file.

The data protection officer wants to know what you hold. HR wants to know whether "everything" can go. Your next IATF surveillance audit is in March. This article works through how the two obligations fit together. They are compatible, but you have to separate the data more carefully than most calibration registers do.

Why "just delete his name" breaks the record

A calibration record is evidence that a particular instrument was within tolerance on a particular date, as judged by a particular competent person. Without the third element it is not complete evidence.

ISO/IEC 17025:2017, clause 7.5.1, says technical records must include the identity of the personnel responsible for each laboratory activity and for checking data and results. IATF 16949 7.1.5.2.1 requires calibration/verification records, and ISO 9001 7.2 requires documented evidence that the people doing the work were competent. An auditor who picks a 2019 gauge record and asks who performed the as-found check, and whether that person was qualified at the time, needs to find a name and a training record. "Former employee" is not an answer.

So a blanket erasure would damage the history your quality system rests on. Deleting a person can mean losing the signature on a record you are obliged to keep.

What GDPR actually lets you keep

Article 17 has exceptions written into it, and Article 17(3) is the one that matters here. Erasure does not apply where processing is necessary:

• for compliance with a legal obligation under Union or Member State law (17(3)(b)), or
• for the establishment, exercise or defence of legal claims (17(3)(e)).

One caution before relying on (b). ISO 9001, IATF 16949 and AS9100 are not law. Your registrar’s expectations and your customer’s retention clause are contracts. They are real obligations, but they are not legal ones in the Article 17 sense. Sector regulation does count. Medical device manufacturers, for example, keep technical documentation for at least 10 years after the last device is placed on the market under the MDR (15 for implantables). For most automotive and general-industry plants, though, the stronger ground is (e).

The new Product Liability Directive, (EU) 2024/2853, gives that ground a concrete time frame. Member States must transpose it by 9 December 2026. Liability runs for 10 years after a product is placed on the market, and up to 25 years where a personal injury is latent. If a fastener torqued with a tool your technician calibrated becomes part of a claim, the calibration record and the name on it are your defence. Keeping them for that purpose is exactly what 17(3)(e) describes.

Your registrar sets the minimum. IATF 16949 7.5.3.2.1 requires records to be kept for as long as the product is active for production and service, plus one calendar year, unless a customer or regulator specifies longer. That is the floor. The liability horizon is usually the ceiling.

A worked example: splitting one person into three data sets

Take the request above. The technician (call him Marco) was in the register from 2015 to 2025. Here is how a well-run response sorts his data.

1. Account and contact data: erase. His login, work email, phone extension, profile photo, notification settings, and any personal mobile number someone typed into a spreadsheet "for emergencies". None of these is needed to prove that a gauge was in tolerance. They have no exception to rely on, so they go. In a system this means a deactivated account that can no longer sign in. In a spreadsheet it means searching every copy, which is where a spreadsheet costs you.

2. Evidential data on calibration records: retain and restrict. His identity as the performer or checker on each as-found/as-left record, each certificate he uploaded, and each check-out and return in the possession history. These stay unchanged, under 17(3)(e) and wherever your sector has a statutory retention rule. They should also become harder to reach. Restricting processing (Article 18) means the data is held for its purpose and is not reused, for example in productivity dashboards or exported staff lists.

3. Competence evidence: retain for as long as the records it supports. His training and qualification records, meaning the proof that he was authorised for the torque procedure in 2021, are the other half of every record in bucket 2. They share its retention end. Deleting them early leaves the calibration records unsupported, and auditors check exactly that link.

Then answer him. Article 12(3) gives you one month, extendable by two further months for complex requests. Article 12(4) requires that where you are not erasing something, you tell him why and that he can complain to a supervisory authority. A clear letter covers it: what was deleted, which records remain, the legal ground, and the date retention ends. That date matters, because "we keep it forever" is not a retention period.

The objection: "Pseudonymise the names and be done"

It sounds like a tidy compromise. Replace "M. Ruiz" with "TECH-0417", keep the key somewhere, and everyone is satisfied. It isn’t that simple, for three reasons.

First, under GDPR pseudonymised data is still personal data (Recital 26). If you keep the key, you have not erased anything, and you have added a second dataset to protect. Second, if you destroy the key you are back to a record whose performer cannot be identified or linked to a competence record. That is the audit failure you were trying to avoid. Third, pseudonymisation applied retrospectively to records that were signed is a change to a signed record. An auditor or a court will ask who changed ten years of records after the fact, and why.

The opposite objection also fails. "Keep everything, it’s safer" breaches the storage-limitation principle in Article 5(1)(e). It also leaves you with no answer when the data protection officer asks when Marco’s data will ever be deleted. Over-retention is a finding waiting to happen. It just shows up in a different kind of audit.

The takeaway: decide the buckets before the email arrives

A request like this becomes a crisis when the data model mixes identity, evidence and contact details in one table, or one spreadsheet column. It is routine when, for each record type, you already know three things: the purpose, the legal ground for keeping it, and the date it ends. Write that rule into your record-control procedure (ISO 9001 7.5.3) and have the DPO sign it off. The next erasure request then gets a one-month answer instead of a three-department debate.

That separation is how PrüfDesk is designed to work. A tenant admin can deactivate a former employee so they can no longer sign in, and the deactivation itself is logged. Every as-found/as-left record, certificate and possession entry they signed keeps its original author. Training records sit alongside the calibration history they support. PrüfDesk does not answer the legal question for you, which belongs to you and your DPO. It does make sure that the answer you reach can be carried out without rewriting your audit trail.