What are GDPR Laws concerning requirement to back up data

Question

I want to create an application where I want to act as a data controller & data processor. The only data I want to record myself is basic user data like username, address , etc.

But I want to run an analytics platform that would work on users' provided data. I do not want to own this data and keep it in user owned data storage (like Dropbox, Google Drive etc.)

How does it affect compliance with GDPR specification with right to access & right to erasure? Especially because as a processor we do not own any data (even data collated from users' data).

Answer 1

As a Data Controller, you have an obligation to implement appropriate technical and organizational measures (TOMs) to ensure compliance and security. Art 32 suggests that you'll want to consider an appropriate strategy, to ensure, if appropriate,

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

aka. backups.

As a Data Processor, you have different obligations though.

Your primary responsibility is to follow the Controller's instructions as specified in the Art 28 data processing agreement or similar contract. Art 28 does say that the Controller must require the Processor to implement appropriate measures per Art 32, so this contract will typically have an appendix with a list of security measures. Per EDPB guidance, it is also OK if you offer a SaaS service with a fixed list of security measures, and by signing up to the service the Controller agrees that the measures are appropriate. But ultimately, only the Controller can determine what is appropriate.

As a Processor, you are not allowed and not required to handle data subject requests, unless instructed to do so by the Controller. However, you're required by Art 28(1)(e) to assist the Controller with these responsibilities. For example, an SaaS solution might offer an admin panel for deleting and exporting data.

If you (and your sub-processors) do not store the source data and derived personal data, this greatly simplifies your responsibilities. Your TOMs will likely focus on managing access tokens and protecting the data while it is being analyzed.

The tricky question for you is now to figure out for which activities you act as a Controller, and for which as a Processor. EDPB guidelines 07/2020 on the concepts of controller and processor or the ICO guide for Controllers and Processors might help. While the GDPR says that a Controller is whoever participatea in determining the purposes and means of processing, some low-level decisions (such as concrete details of a backup strategy) can be left to Processors.