Backups and privacy law: erasure, retention and residency in every copy
By Brandon Potts · 23 October 2026
Privacy programs usually focus on production systems: the CRM, the website, the HR platform. But for most organisations, the largest store of personal data isn’t production at all. It’s the backup and archive estate — years of copies, often in more than one country.
Regulators know this. Laws such as the EU and UK GDPR, Australia’s Privacy Act, Singapore’s PDPA and India’s new DPDP framework apply to personal data wherever it sits, including backups.
1. Retention limits apply to backups
Most privacy laws say personal data should not be kept longer than necessary. A backup policy that keeps everything for seven years “just in case” may conflict with that. Retention should be set deliberately, documented, and justified by legal, regulatory or business need.
2. Erasure requests need a backup process
Deleting an individual’s record from every backup is rarely practical. Regulators generally accept a defensible alternative: put the data “beyond use” in backups, let it expire with normal retention, and make sure that if a backup is ever restored, the deletion is re-applied before the data goes back into use. The key is having that process documented — and following it.
3. Every copy has a location
Offshore DR sites and cloud storage regions are cross-border transfers. Rules in the EU, UK, China, Québec and elsewhere may require assessments or specific safeguards before personal data leaves the country. Know where each copy lives.
4. Restoring is a legal obligation, too
GDPR Article 32, NIS2, DORA and APRA CPS 230 all expect organisations to restore data and services after an incident — and to test that they can. Recovery testing is compliance evidence.
Where to start
Map your backup and archive policies against your retention obligations, document an erasure-and-restore process, and list every location where copies are stored. Use the regulation finder to see which laws apply in each region you operate in.
General information only, not legal advice.