Backups contain personal data.
WHAT THIS MEANS
A backup of your database contains everything the database does: customer names, addresses, emails, order history.
Under the NDPR and comparable frameworks, that data carries obligations wherever it is stored.
PRACTICAL MEASURES
Protect backup storage: strong passwords, two-factor authentication on the storage account
Encrypt backups where your tool supports it, particularly if stored with a third party Apply a retention policy, since keeping personal data indefinitely is difficult to justify Know where your backups are and who can access them
THE DELETION TENSION
If someone asks for their data to be deleted, it exists in your backups as well as your live database.
The usual practical position is that backups are not edited, and the data is removed as backups age out under your retention policy.
Document your approach rather than ignoring the question.
WHO CAN ACCESS THEM
A developer with access to your backup storage has your entire customer database. Consider that when granting access.
THIS IS GENERAL GUIDANCE
Take proper advice on what applies to your business.
