0

GDPR requires retaining personal data after a certain time period defined based on the following clauses:

  1. the current and future value of the information;
  2. the costs, risks and liabilities associated with retaining the information; and
  3. the ease or difficulty of making sure it remains accurate and up to date.

The statement does not include any specification to where the personal data can be archived and by which format e.g., backup files, logs etc.

Based on the above can a company use a secondary backup database with strict access control to keep the retained personal data? This database will not take part in production transactions nor services use.

Improve this question
5
  • Are you asking if we still will be allowed to keep backups after May 25?
    – Free Radical
    Commented May 13, 2018 at 12:19
  • I'm asking if secondary non operational database can be treated as an archive for personal data.
    – OrenYa
    Commented May 13, 2018 at 13:23
  • Yes. A secondary non operational database can be treated as an archive for personal data. In fact, under GDPR it must (if it contains personal data).
    – Free Radical
    Commented May 13, 2018 at 13:24
  • Thanks for answering. The database will hold PD transfered from the production operational database after a certain period of time. Additionally, the secondary server will be restricted to specific privileged personnel and will be fully audited, monitored and protected. Is it possible to share a GDPR source that explains this solution as in compliance with the retention requirement? Unfortunately I didn't found one.
    – OrenYa
    Commented May 13, 2018 at 17:41
  • Is it also possible to create a database on the same production SQL instance with logical restrictions and to still be in compliance with the requirement? The created database will not be operational of course and will only hold historic PD with encryption at rest.
    – OrenYa
    Commented May 13, 2018 at 17:58

1 Answer 1

Reset to default
2

The requirement to keep have a backup scheme in place follows from the GDPR Article 32 (1)c), which say that the controller and processor, among other things, shall make sure that there exists

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

To determine whether a backup arrangement is compliant with GDPR, you need to carry out a risk assessment according to the risk assessment guidelines. Depending on the personal data you are processing and the type of processing you do, you may have to create a DPIA (Data Protection Impact Assessment) as described in the GDPR Article 35. If the processing does not produce high risk, it is legal.

If you risk assessment shows high risk, you must add layers of security, such as encryption, until there no longer is a high risk.

For the record: Whether the security of a specific backup solution, such as the backup solution described in the question, is adequate according to the GDPR, cannot be answered here. To find the answer, you must carry out the risk assessment. This can only be done by someone with detailed knowledge about the specific computer system and the personal data processed.

Our DPO has compiled a guideline for doing a DPIA. I've placed an online copy here: http://diw.ifi.uio.no/sites/default/files/dpia.pdf

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .