Where records retention is required.
WHAT MAY APPLY
Tax record retention Contractual obligations Sector-specific regulatory requirements Data protection obligations under the NDPR
This is general guidance rather than advice. Take proper advice on what applies to your business.
WHAT IT MEANS PRACTICALLY
Some data may need keeping for years, which is longer than typical backup retention.
Backups are not a records system. If you must retain records, export them deliberately rather than relying on backups being there.
THE TENSION WITH DATA PROTECTION
Retention obligations require keeping data. Data protection principles require not keeping personal data longer than necessary.
These are reconcilable and require thought about what is kept, for how long, and why.
BACKUPS CONTAINING PERSONAL DATA
A backup of your database contains everything the database does, including customer personal data.
Protect backups accordingly: encrypted, access-controlled, and deleted according to your retention policy.
WHAT TO DO
Establish what you must retain, export it deliberately, store it securely, and set a retention period for backups separately.
