GDPR Guidance - Backup Question and Answers

[rom1984]

Hi All,

 

I've got the go ahead to draft up some guidance on the ICO's position in relation to backups. I'm going to do it in the form of a questions & answers piece or as a blog post depending on how it turns out.

 

Has anyone got any specific questions that they would like seeing addressed in it.

 

I've got some ideas from @enjay 's thread (see http://www.edugeek.net/forums/data-protection-information-handling/185799-right-delete-backups.html) but wanted to do it as a separate thread so I can just easily pull out the relevant bits.

 

The things I had in mind are;

 

GDPR's position on backups

The lawful bases for processing the data vs the right to erasure

Questions around right to erasure - the ICOs' position on this

Encryption Requirements

Data Retention expectations

Backups to the cloud

Privacy by Design (for manufactures of backup appliances and for Network Manager types that are responsible for developing systems, procedures, infrastructure etc)

Tape Backups - how are they different, what the ICOs position is

VSS Backups - Thinking around does the ICO expect you to basically break the VSS to delete the data, if not what is the ICO's position, retention periods of VSS

Virtualised infrastructures vs Physical - how does this change the expectations of the ICO

 

 

@GrumbleDook I think you said in the other thread you gave the ICO some questions to address - could I pinch them off you either via PM/email or on this thread?

 

I've obviously got to be quite broad because the guidance will be for all organisations so I might not be able to include specific nuanced examples but I'll try to cover the general expectations of the ICO.

 

Thanks all!

Edited February 16, 2018 by rom1984

[GrumbleDook]

Brilliant news @rom1984. I’ll drop you an email as soon as I can.