Personal data you cannot easily edit.
WHY THEY ARE DIFFICULT
Backups are point-in-time copies, and editing them is impractical.
WHAT THE USUAL POSITION IS
Backups expire on their cycle rather than being modified.
WHAT TO DO
Define and document that approach.
WHAT TO STATE IN RESPONSES TO DELETION REQUESTS
That live systems are cleared, and backups expire within a stated period.
WHAT TO ENSURE
That the period is not indefinite.
WHY
Backups retained forever mean data retained forever.
WHAT TO SET
A retention period for backups, deliberately.
WHAT TO BALANCE
Recovery needs against retention obligations.
WHAT TO ENSURE ABOUT RESTORED DATA
That deletions are reapplied after any restore.
WHY
Restoring resurrects data you deleted.
WHAT THAT REQUIRES
A record of what was deleted, kept long enough to reapply.
WHAT TO SECURE
Backups themselves.
WHY
They are frequently the least protected copy of everything.
WHAT TO APPLY
Encryption Access control Storage in a separate account or location
WHAT ARCHIVES REQUIRE
The same treatment as live data.
WHY
Archived is not a category the law recognises.
WHAT TO REVIEW
What archives exist, and whether they are still needed.
