GDPR Retention - Secondary Database
<p>GDPR requires retaining personal data after a certain time period defined based on the following clauses:</p>

<ol>
<li>the current and future value of the information;</li>
<li>the costs, risks and liabilities associated with retaining the information; and</li>
<li>the ease or difficulty of making sure it remains accurate and up to date.</li>
</ol>

<p>The statement does not include any specification to where the personal data can be archived and by which format e.g., backup files, logs etc. </p>

<p>Based on the above can a company use a secondary backup database with strict access control to keep the retained personal data? This database will not take part in production transactions nor services use.</p>

<p>The <em>requirement</em> to keep have a backup scheme in place follows from the GDPR <a href="https://gdpr-info.eu/art-32-gdpr/" rel="nofollow noreferrer">Article 32</a> (1)c), which say that the controller and processor, among other things, shall make sure that there exists</p>

<blockquote>
  <p>the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident</p>
</blockquote>

<p>To determine whether a backup arrangement is compliant with GDPR, you need to carry out a <a href="https://gdpr-info.eu/recitals/no-76/" rel="nofollow noreferrer">risk assessment</a> according to the <a href="https://gdpr-info.eu/recitals/no-77/" rel="nofollow noreferrer">risk assessment guidelines</a>. Depending on the personal data you are processing and the type of processing you do, you may have to create a DPIA (Data Protection Impact Assessment) as described in the GDPR <a href="https://gdpr-info.eu/art-35-gdpr/" rel="nofollow noreferrer">Article 35</a>. If the processing does not produce <strong>high risk</strong>, it is legal. </p>

<p>If you risk assessment shows high risk, you must add layers of security, such as encryption, until there no longer is a high risk.</p>

<p>For the record: Whether the security of a <em>specific</em> backup solution, such as the backup solution described in the question, is adequate according to the GDPR, cannot be answered here. To find the answer, you must carry out the risk assessment. This can only be done by someone with detailed knowledge about the specific computer system and the personal data processed.</p>

<p>Our DPO has compiled a guideline for doing a DPIA.  I've placed an online copy here: <a href="http://diw.ifi.uio.no/sites/default/files/dpia.pdf" rel="nofollow noreferrer">http://diw.ifi.uio.no/sites/default/files/dpia.pdf</a></p>

gdpr