4 ms·

If you are backing up users data that is not yours to own and do with as you please, yes you absolutely can have to many backups. If you are required by law or

by zie 4y ago

If you are backing up users data that is not yours to own and do with as you please, yes you absolutely can have to many backups. If you are required by law or policy to erase user data and it's in your backup(s), you now have a real problem on your hands. Note: Sometimes the law/policy will make a carve-out exception for backups, if so, yay for you! I'm not currently aware of a law that does this.

JadeNB 4y ago
> Note: Sometimes the law/policy will make a carve-out exception for backups, if so, yay for you! I'm not currently aware of a law that does this. I am confused by these sentences. Sometimes the law does it, but you're not aware of a law that does it?
- alliao 4y ago
  laws have jurisdiction so he's probably saying he doesn't know all laws from all jurisdictions?
- zie 4y ago
  Essentially yes. I can't know all laws for all jurisdictions(nor would I want to), but laws could make a carve-out provision. I'm not currently aware of any that matter in my jurisdiction(s). That doesn't mean there aren't some out there somewhere. Policies are of course a different thing, and they may or may not apply to you, from industry regulations or cyber security insurance or just company or trade group policies that might apply.
bombcar 4y ago
GDPR apparently does: https://www.itgovernance.eu/blog/en/the-gdpr-how-the-right-to-be-forgotten-affects-backups-2 https://www.itgovernance.eu/blog/en/the-gdpr-how-the-right-t... If data is on backup tapes you seem to be able to inform them of how long your retention policies are.
- msh 4y ago
  There is a bit more than just informing users: If you decide to go down this route, you should bear in mind that other supervisory authorities might be stricter and that you must be able to demonstrate that it’s impractical to delete backup data. This will require, at the very least, a risk assessment, business impact assessment and data protection impact assessment.
NoPicklez 4y ago
There's two aspects to this 1) Holding backups for too long that eventually contain user data you no longer need and 2) backing up user data that you no longer needed in the first place. Working in security I have been advising clients to make sure that they consider their obligations for retention periods. Not just so that you release user information you no longer need at the point you no longer need it, but also to reduce litigation if there were to be a data breach.
abigail95 4y ago
Use an encryption key hierarchy and delete (one of) the keys Until a court or politician says otherwise, "Deleting data" means inaccesible, not physically destroyed. AFAIK GDPR, CCPA don't specify deletion means physical destruction. You can kill one or one-thousand backups with the same effort.
- zie 4y ago
  Definitely one good way to solve this problem.

by zie 4y ago

JadeNB 4y ago

> Note: Sometimes the law/policy will make a carve-out exception for backups, if so, yay for you! I'm not currently aware of a law that does this. I am confused by these sentences. Sometimes the law does it, but you're not aware of a law that does it?

alliao 4y ago
laws have jurisdiction so he's probably saying he doesn't know all laws from all jurisdictions?
zie 4y ago
Essentially yes. I can't know all laws for all jurisdictions(nor would I want to), but laws could make a carve-out provision. I'm not currently aware of any that matter in my jurisdiction(s). That doesn't mean there aren't some out there somewhere. Policies are of course a different thing, and they may or may not apply to you, from industry regulations or cyber security insurance or just company or trade group policies that might apply.

bombcar 4y ago

GDPR apparently does: https://www.itgovernance.eu/blog/en/the-gdpr-how-the-right-to-be-forgotten-affects-backups-2 https://www.itgovernance.eu/blog/en/the-gdpr-how-the-right-t... If data is on backup tapes you seem to be able to inform them of how long your retention policies are.

msh 4y ago
There is a bit more than just informing users: If you decide to go down this route, you should bear in mind that other supervisory authorities might be stricter and that you must be able to demonstrate that it’s impractical to delete backup data. This will require, at the very least, a risk assessment, business impact assessment and data protection impact assessment.

NoPicklez 4y ago

There's two aspects to this 1) Holding backups for too long that eventually contain user data you no longer need and 2) backing up user data that you no longer needed in the first place. Working in security I have been advising clients to make sure that they consider their obligations for retention periods. Not just so that you release user information you no longer need at the point you no longer need it, but also to reduce litigation if there were to be a data breach.

abigail95 4y ago

Use an encryption key hierarchy and delete (one of) the keys Until a court or politician says otherwise, "Deleting data" means inaccesible, not physically destroyed. AFAIK GDPR, CCPA don't specify deletion means physical destruction. You can kill one or one-thousand backups with the same effort.

zie 4y ago
Definitely one good way to solve this problem.