The requirement to keep have a backup scheme in place follows from the GDPR Article 32 (1)c), which say that the controller and processor, among other things, shall make sure that there exists

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

To determine whether a backup arrangement is compliant with GDPR, you need to carry out a risk assessment according to the risk assessment guidelines. Depending on the personal data you are processing and the type of processing you do, you may have to create a DPIA (Data Protection Impact Assessment) as described in the GDPR Article 35. If the processing does not produce high risk, it is legal.

If you risk assessment shows high risk, you must add layers of security, such as encryption, until there no longer is a high risk.

For the record: Whether the security of a specific backup solution, such as the backup solution described in the question, is adequate according to the GDPR, cannot be answered here. To find the answer, you must carry out the risk assessment. This can only be done by someone with detailed knowledge about the specific computer system and the personal data processed.

I have written a guideline for doing a DPIA for our own staff. I've placed a copy online here: http://diw.ifi.uio.no/sites/default/files/dpia.pdf

The requirement to keep have a backup scheme in place follows from the GDPR Article 32 (1)c), which say that the controller and processor, among other things, shall make sure that there exists

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

To determine whether a backup arrangement is compliant with GDPR, you need to carry out a risk assessment according to the risk assessment guidelines. Depending on the personal data you are processing and the type of processing you do, you may have to create a DPIA (Data Protection Impact Assessment) as described in the GDPR Article 35. If the processing does not produce high risk, it is legal.

If you risk assessment shows high risk, you must add layers of security, such as encryption, until there no longer is a high risk.

For the record: Whether the security of a specific backup solution, such as the backup solution described in the question, is adequate according to the GDPR, cannot be answered here. To find the answer, you must carry out the risk assessment. This can only be done by someone with detailed knowledge about the specific computer system and the personal data processed.

Our DPO has compiled a guideline for doing a DPIA. I've placed an online copy here: http://diw.ifi.uio.no/sites/default/files/dpia.pdf