--- title: "Backup and the GDPR “Right to Be Forgotten”: Recommendations — ZEBR.ai" description: "(Part two of two)" url: "https://zebr.ai/en/blog/backup-and-the-gdpr-right-to-be-forgotten-recommendations" markdown_url: "https://zebr.ai/en/blog/backup-and-the-gdpr-right-to-be-forgotten-recommendations.md" language: "en" published: "2018-03-01T09:50:42+00:00" alternates: cs: "https://zebr.ai/cs/blog/zalohovani-a-pravo-byt-zapomenut-podle-gdpr-doporuceni.md" sl: "https://zebr.ai/sl/blog/varnostno-kopiranje-in-pravica-do-pozabe-v-skladu-z-gdpr-priporocila.md" sk: "https://zebr.ai/sk/blog/zalohovanie-a-pravo-byt-zabudnuty-podla-gdpr-odporucania.md" hr: "https://zebr.ai/hr/blog/sigurnosno-kopiranje-i-pravo-na-zaborav-prema-gdpr-u-preporuke.md" sr-Latn: "https://zebr.ai/sr-latn/blog/pravljenje-rezervnih-kopija-i-pravo-na-zaborav-prema-gdpr-u-preporuke.md" bs: "https://zebr.ai/bs/blog/izrada-sigurnosnih-kopija-i-pravo-na-zaborav-prema-gdpr-u-preporuke.md" sq: "https://zebr.ai/sq/blog/rezervimi-dhe-e-drejta-per-t-u-harruar-sipas-gdpr-rekomandime.md" fr: "https://zebr.ai/fr/blog/sauvegarde-et-droit-a-l-oubli-selon-le-rgpd-recommandations.md" es: "https://zebr.ai/es/blog/copias-de-seguridad-y-el-derecho-al-olvido-conforme-al-rgpd-recomendaciones.md" de: "https://zebr.ai/de/blog/datensicherung-und-das-recht-auf-vergessenwerden-gemaess-dsgvo-empfehlungen.md" pt-BR: "https://zebr.ai/pt-br/blog/backup-e-o-direito-ao-esquecimento-segundo-o-gdpr-recomendacoes.md" pl: "https://zebr.ai/pl/blog/tworzenie-kopii-zapasowych-a-prawo-do-bycia-zapomnianym-zgodnie-z-gdpr-zalecenia.md" it: "https://zebr.ai/it/blog/backup-e-diritto-all-oblio-ai-sensi-del-gdpr-raccomandazioni.md" nl: "https://zebr.ai/nl/blog/back-ups-en-het-recht-om-vergeten-te-worden-volgens-de-avg-aanbevelingen.md" hu: "https://zebr.ai/hu/blog/biztonsagi-mentes-es-a-gdpr-szerinti-elfeledteteshez-valo-jog-ajanlasok.md" ro: "https://zebr.ai/ro/blog/backup-si-dreptul-de-a-fi-uitat-conform-gdpr-recomandari.md" tr: "https://zebr.ai/tr/blog/gdpr-kapsaminda-yedekleme-ve-unutulma-hakki-oneriler.md" id: "https://zebr.ai/id/blog/pencadangan-dan-hak-untuk-dilupakan-menurut-gdpr-rekomendasi.md" --- [Home](https://zebr.ai/en/) [Blog](https://zebr.ai/en/blog) Backup and the GDPR “Right to Be Forgotten”: Recommendations # Backup and the GDPR “Right to Be Forgotten”: Recommendations (Part two of two) 01/03/2018 · 5 min read · ZEBR.ai editorial team (Part two of two) The European Union’s General Data Protection Regulation (GDPR) officially comes into effect on May 25, 2018, and it is natural to ask questions about the right to be forgotten and its impact on personal data stored in backup archives. We explored these questions [in the first part of the post](https://www.zebra.cz/zalohovani-pravo-byt-zapomenut-v-gdpr-co-cekat/), and now we will discuss how to address them. We concluded that the issue of complying with a data subject’s right to be forgotten in backup archives can be summarized in two key questions: - • How can data be protected if a copy of it persists in a backup archive? - • How can the data minimization principles introduced by GDPR be observed, meaning retaining only the minimum necessary data for only as long as it is needed? ### Best practices for handling personal data Acronis has several best practices and product features designed to help partners (including MSPs offering backup as a service on the Acronis Data Cloud platform) and their customers (companies acting as controllers of EU residents’ personal data) comply with their new obligations: - • Where possible, controllers should organize backups so that a separate backup archive exists for each data subject and their personal data. - – This is the ideal solution because it enables granular deletion of personal data without affecting other individuals’ records. - – Unfortunately, this approach is difficult for most businesses to implement, as data subjects’ personal data is often spread across multiple applications, locations, storage devices and backups. - • Backup archives should be secured with strong encryption so they cannot be misused even if criminals gain access to them. - • When an individual requests the deletion of their personal data, the controller should be fully transparent and open about the further process regarding backups: - – The primary instances of their data in production systems will be deleted as promptly as possible. - – Their personal data may remain in backup archives somewhat longer, either because it is impossible to isolate individual personal data within an archive or because the controller is obliged to retain the data longer due to contractual, legal or other regulatory obligations. - – The individual should be assured that their personal data will not be restored to production systems (except in certain rare cases, such as the need for recovery after a natural disaster or a serious security breach – in such cases, the controller will take the necessary steps not to violate the original request and will delete the data again from the primary instance). - – Backup archives containing personal data will be protected by strong encryption so they cannot be misused even if criminals gain access to them. - – Retention rules are in place to ensure that personal data in archives is retained only for the strictly necessary period and then automatically deleted. - – Records of all data subject requests concerning their personal data will be retained, as will audit logs recording all activities involving backup archives containing personal data. This means users can be confident that their personal data is backed up in accordance with the GDPR principles of security-by-design-and-by-default and data minimization, and that their rights, including the right to be forgotten, will be respected. ### How Acronis complies with the right to be forgotten when acting as a personal data controller Acronis will respect the rights of all data subjects regarding their personal data, including the right to be forgotten, when the data is no longer needed for its original purposes or when a user withdraws their consent to processing. When Acronis receives a deletion request from a customer, we will delete their personal data (e.g., first name, surname, postal addresses, telephone numbers) from our production systems within 30 days, unless there is a legal basis for further processing. Personal data will be deleted from our backup copies of that data in archives as soon as practically possible, to the extent permitted by our other data retention obligations (e.g., to protect other data stored in the same backup archives or due to other regulatory and legal obligations). Once these obligations have been fulfilled, we will permanently delete the data as quickly as possible. Acronis will also retain audit logs documenting the history of all operations involving customers’ personal data for the period required by legal obligations. Certain items that a user may consider to be their personal data, such as community forum posts or [reviews](https://www.acronis.com/en-us/company/awards/#reviews), may be retained in accordance with the terms of the service to which the user agreed when publishing them. Acronis will always strive to exhaust all available means to keep personal data secure and inaccessible to unauthorized persons. ### Conclusion Whether you are a controller, a processor, or [both under GDPR](https://www.acronis.com/en-us/blog/posts/gdpr-primer-general-concepts), fulfilling data subjects’ right to be forgotten is fairly straightforward: if their data appears in production systems, you must delete it promptly. However, copies of the same data stored in backup archives may be a somewhat more complex issue: you must also delete them as soon as possible, but you may simultaneously have other obligations to retain them longer. The most reliable way to avoid potential regulatory compliance violations and related hefty fines is to follow the same general GDPR principles for backups as for personal data in production systems: - • Take reasonable steps to keep backup archives secure from unauthorized access, - • Do not retain archives longer than is truly necessary, - • Log and document your policies, procedures and actual operations involving backup archives so that you can always demonstrate that you acted with due diligence in respecting data subjects’ rights concerning their personal data stored in backups. Be open with users and explain why their personal data may be retained longer, how you will keep it secure until it is deleted, and when that will eventually happen. Author: James Slaby *Please note that this post is for informational purposes only. It is not intended and should not be construed as legal advice. You should not act on the basis of this post without further legal or other professional advice.* Source: Article author: ZEBR.ai editorial team Read on ## More related articles [All articles](https://zebr.ai/en/blog) Contact ## Do you need a solution for yourself or for your client? Tell us which service you are looking into, and a specialist in that area will get back to you directly. [(704) 745-4214](tel:+17047454214)\ --- - Source: - Site overview for AI agents: