Guide · Data protection
Backup under the GDPR: what you need to consider
In short: the GDPR actually requires backups – Art. 32 demands the ability to restore personal data promptly after an incident. At the same time, backups are themselves personal data: they must be protected, stored in a suitable place, covered by a contract and deleted according to fixed periods.
What Art. 32 GDPR requires
Art. 32 obliges controllers to take technical and organisational measures that ensure a level of security appropriate to the risk. For backups, four points of paragraph 1 are decisive:
| Requirement | What it means for backups |
|---|---|
| Point (a) – encryption | Encrypt backups, ideally before they leave the system being backed up |
| Point (b) – confidentiality, integrity, availability, resilience | Copies in several places, protection against tampering, access only for authorised persons |
| Point (c) – timely restoration | Restoring must be possible and feasible within a reasonable time |
| Point (d) – regular testing | Check that the measures are effective – for backups: test the restore |
Where backups may be stored
The GDPR does not prohibit the cloud or service providers. It does, however, require transfers to countries outside the EU and the EEA to be specially safeguarded (Chapter V). The simplest option is a storage location in Germany or the EU with a provider subject to European law. If the backups are encrypted and the key stays with the company, not even a storage provider can learn anything about their content.
Data processing on behalf of the controller
If a service provider runs the backup or stores the backups, it is usually a processor under Art. 28 GDPR. A data processing agreement (DPA) is then required, covering the subject matter, duration, type of data, the technical and organisational measures and how sub-processors are handled.
Deletion and storage limitation
Under the principle of storage limitation (Art. 5(1)(e)), data may not be kept longer than necessary. For backups this means setting fixed retention periods and deleting backups automatically once they have passed. Removing individual records from a backup is usually not technically sensible and would damage the backup. Common practice is therefore:
- backups expire in full at the end of their retention period;
- until then they are protected against access and not used for other purposes;
- if a backup is restored, previously deleted data is deleted again – for this purpose a record is kept of which deletions need to be repeated.
The details belong in the deletion and backup plan and should be agreed with the data protection officer.
Documenting
Under the accountability principle (Art. 5(2)), a company must be able to demonstrate that it complies with the principles. For backups this means a written plan, a record of backups and deletions and documented restore tests.
How AegisGrid helps
AegisGrid encrypts with AES-256-GCM or ChaCha20-Poly1305 on the system being backed up; the key stays with you. You decide where the backups are kept – on your own premises, at a second site or in the AegisGrid cloud storage in certified data centres in Germany. For cloud storage and Managed Backup, MSD Computersysteme GmbH concludes a data processing agreement under Art. 28 GDPR. Retention periods apply per backup and destination, the backup server cleans up expired backups automatically, and every deletion is recorded in the signed evidence log.
This article is a general introduction and not legal advice. Agree your plan with your data protection officer.
Frequently asked questions about the GDPR and backup
Do I have to change the backups when someone asks for their data to be deleted?
In practice, backups are usually not edited individually but expire at the end of their retention period. Until then they are protected and not used for anything else; if a backup is restored, the deletions are repeated. You should define the details with your data protection officer.
May I store backups in the cloud?
Yes, with a data processing agreement and suitable safeguards for the storage location. The simplest option is a provider with data centres in Germany or the EU, and with encryption before transfer the content stays unreadable even for the provider.
How long should I keep backups?
As long as you need them for restoring, and no longer. Common practice is daily versions for a few weeks and monthly or yearly versions for a longer period. Statutory retention obligations, for example for accounting records, are better met with archiving than with backups.
Set up backups in line with data protection
We advise you on storage location, retention periods and the data processing agreement.