4 ms·
Seems easy to me. 30 days, delete backup keys. What’s the problem? You still have 29 day old backups?
by bottled_poe 5y ago
Seems easy to me. 30 days, delete backup keys. What’s the problem? You still have 29 day old backups?
- Silhouette 5y agoMaybe we're talking about slightly different things here. The suggestion to use individual keys to encrypt personal data is usually made so that deleting a key has effectively and immediately destroyed all copies of the data including any historical ones. That way you're definitely fully compliant with any right to be forgotten requests with one simple act. Even if you do have some older backups or archives kept around or the backup data isn't truly irretrievable from the physical media where it was stored after being marked for deletion, that data instantly becomes random noise without the key (which you obviously don't store and backup in the same way in this kind of scheme). In other words, it's not really about whether keeping backups for a few days or a few weeks before they are "deleted" would be considered acceptable by regulators, it's about making all such questions irrelevant while otherwise being able to continue with business as usual. It would be a clever and useful solution to the regulatory compliance problem in this area, if it worked in practice.