UK GDPR and backups: retention and the right to erasure
Key takeaways
- Article 32 of the UK GDPR expects the ability to restore personal data in a timely manner after an incident, and regular testing of security measures
- The UK GDPR sets no fixed retention periods: you decide how long to keep data and must be able to justify it
- A valid erasure request reaches backups as well as live systems, unless an exemption applies
- The ICO accepts that data may stay in a backup until it is overwritten, provided it is put beyond use and not used for anything else
- You must be absolutely clear with people about what happens to their data in backups when you fulfil an erasure request
Backups sit in an awkward spot under UK GDPR. The law expects you to be able to restore personal data after an incident, which means keeping copies. It also says not to keep personal data longer than you need, and gives people a right to have their data erased. The ICO's guidance shows how those fit together, and it is more practical than many IT teams expect.
Does UK GDPR require backups?
It does not use the word, but Article 32 comes close. It requires appropriate technical and organisational measures for security, including as appropriate "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident".
The same article lists "a process for regularly testing, assessing and evaluating the effectiveness" of those measures. The ICO's data security checklist includes making sure you can restore access to personal data after an incident, such as by establishing an appropriate backup process.
In our view, a backup you have never restored from is weak evidence of compliance. Our guide to how often to test disaster recovery plans covers testing, and the 3-2-1 backup rule guide covers keeping a copy ransomware cannot reach.
How long can you keep backups that contain personal data?
Article 5(1)(e), the storage limitation principle, says personal data must be kept in a form which permits identification of people for no longer than is necessary for the purposes it is processed for.
The ICO says the UK GDPR does not set specific time limits for different types of data. That is up to you, depending on how long you need the data for your purposes. In practice the ICO expects you to:
- know what personal data you hold and why you need it
- carefully consider and be able to justify how long you keep it
- have a policy with standard retention periods where possible
- regularly review your information, and erase or anonymise it when you no longer need it
A retention schedule lists the types of record you hold, what you use them for and how long you intend to keep them. Backups belong in that schedule like any other copy. The ICO also advises having a system for making sure retention periods are kept in practice, and reviewing them at appropriate intervals.
The ICO's examples show why periods differ: a bank may need to keep ATM CCTV images for several weeks, because a suspicious transaction may not come to light until the victim gets their statement, while a pub may need to keep its CCTV images for only a short period, because incidents come to light very quickly.
Note that the ICO marks its storage limitation guidance as under review because of changes made by the Data (Use and Access) Act, so check for updates.
Does the right to erasure apply to backups?
Yes. The ICO says that if a valid erasure request is received and no exemption applies, you will have to take steps to ensure erasure from backup systems as well as live systems.
What those steps are depends on your circumstances, your retention schedule, particularly for backups, and the technical options available to you. The ICO accepts that erasure may happen at once in live systems while the data remains in the backup environment for a certain period until it is overwritten.
What "beyond use" means
The key test, in the ICO's words, is to put the backup data "beyond use", even if it cannot be immediately overwritten. That means:
- you do not use the data in the backup for any other purpose
- the backup is simply held on your systems until it is replaced in line with an established schedule
Provided that is the case, the ICO says retaining the data in the backup may be unlikely to pose a significant risk, although that depends on the context. This is where a written backup retention schedule earns its keep: it is what turns "it will be overwritten eventually" into an established schedule you can point to.
The ICO also says you must be absolutely clear with people about what will happen to their data when their erasure request is fulfilled, including in backups.
Restoring a backup after an erasure request
The ICO's beyond use test raises a practical question it does not answer directly: what happens if you restore from a backup taken before the erasure. Since the data must not be used for any other purpose, a restore process that brings an erased person's data back into live systems would undo the erasure. Keep a record of erasure requests you have fulfilled, and check restored data against it before it goes back into use.
Deadlines and exemptions
The ICO says you must respond to an erasure request without undue delay and within one month of receipt, and that you can extend this by a further two months if the request is complex or you have received a number of requests from the person.
The right is not absolute. In the ICO's example, a former employee asks to have all their data erased, but the employer can refuse to erase what it needs to keep to meet its legal obligation to disclose salary details to HMRC.
A backup policy that fits UK GDPR
- Put backups in your retention schedule, with a standard retention period for each backup set and a reason for it.
- Make sure you can restore in a timely manner, and test it, to meet Article 32.
- Keep erased data beyond use: no access to backups for anything other than restoring, and overwrite them on schedule.
- Re-apply erasures after a restore, using a log of fulfilled requests.
- Tell people in your privacy information what happens to their data in backups after an erasure request.
Frequently asked questions
Does the right to erasure apply to backups?
Yes. The ICO says that if a valid erasure request is received and no exemption applies, you have to take steps to ensure erasure from backup systems as well as live systems.
Do I have to delete someone from my backups straight away?
Not necessarily. The ICO says data may remain in the backup environment until it is overwritten, as long as it is put beyond use, not used for any other purpose, and replaced in line with an established schedule.
How long can backups containing personal data be kept under UK GDPR?
The UK GDPR does not set specific time limits. You decide based on how long you need the data, document standard retention periods where possible, and must be able to justify them.
Does UK GDPR require backups?
Article 32 lists, as an appropriate measure, the ability to restore the availability and access to personal data in a timely manner after a physical or technical incident. The ICO's security checklist includes establishing an appropriate backup process.
Do I need to test backups under UK GDPR?
Article 32 includes a process for regularly testing, assessing and evaluating the effectiveness of security measures. In our view, that should include checking you can actually restore.
