Restore after an incident
GDPR Article 32, NIS2, DORA and APRA CPS 230 all expect you to restore data and services in a timely way — and to test it.
GLOBAL PRIVACY & COMPLIANCE
Your backups hold personal data. The law applies to them too.
GDPR, Australia’s Privacy Act and dozens of other laws expect you to protect, restore, retain and delete personal data correctly — in every copy, in every country. I make sure your data protection environment can prove it.
WHY BACKUPS MATTER TO REGULATORS
Four obligations most backup environments can’t yet prove.
Keep data only as long as needed
Retention limits apply to backup copies. Keeping everything forever is a compliance risk, not a safety net.
Honour access and erasure rights
When someone asks for their data to be deleted, you need a defensible process for backups — including what happens when an old backup is restored.
Know where every copy lives
Offshore backup and DR sites are cross-border transfers. Residency rules in China, Québec, the EU and elsewhere apply.
REGULATION FINDER
Which laws apply to your data?
Choose a country or region to see the key privacy, cyber and resilience laws — breach deadlines, penalties, and what each one means for your backups.
General information only, not legal advice. Last reviewed October 2026. Laws change — always confirm with the regulator or your legal adviser.
AT A GLANCE
Breach notification deadlines.
If your backups are part of the incident — or your only way out of it — these clocks are already running.
| Region | Rule | Deadline to notify the regulator |
|---|---|---|
| Australia | Privacy Act (NDB) | Assess within 30 days; notify as soon as practicable |
| Australia | Ransomware payment | 72 hours after payment |
| Australia | APRA CPS 234 | 72 hours (material incidents) |
| European Union | GDPR | 72 hours |
| European Union | NIS2 | 24h early warning · 72h notification · 1 month final |
| United Kingdom | UK GDPR | 72 hours |
| United States | SEC (public companies) | 4 business days after materiality determined |
| United States | NYDFS Part 500 | 72 hours |
| Singapore | PDPA | 3 calendar days after deciding it is notifiable |
| Brazil | LGPD | 3 working days |
| Japan | APPI | Preliminary promptly · final within 30/60 days |
HOW I HELP
Turn your backup environment into compliance evidence.
Retention mapping
Map every backup and archive policy to the legal and regulatory retention it supports — and remove what it doesn’t.
Recovery evidence
Documented, repeatable restore tests that satisfy auditors and regulators under CPS 230, DORA, NIS2 and ISO 27001.
Residency review
A map of where every copy of your data is stored, and which transfer rules apply to each location.
Can you prove your backups are compliant?
A compliance-focused health check gives you the evidence, the gaps and the fixes.