GDPR and backup: the concrete obligations your company has for data protection

The GDPR doesn't explicitly mention "backup" as a technical term — and that's exactly why many business owners think it doesn't apply to them. Wrong. The regulation imposes a series of obligations that, in practice, translate directly into the need for a working, documented backup system.

What the GDPR says about data availability

Article 32 of the GDPR requires data controllers to implement technical measures that ensure:

• The ongoing confidentiality and integrity of personal data
• The availability and resilience of processing systems and services
• The ability to restore the availability of data in a timely manner in the event of a physical or technical incident

In IT terms: you're required to be able to recover the personal data of your clients and employees if your systems are compromised. Without backup, you can't do that.

Concrete backup obligations under the GDPR

In concrete terms, the GDPR implies four backup-related requirements that a company in Romania has to meet:

1. Backup copies must exist. Not optional — mandatory for any company that processes personal data (including employee and client data).
2. The backup must be encrypted. Personal data must also be protected in backup copies. An unencrypted backup on an external hard drive doesn't meet the GDPR requirement.
3. There must be tested restore procedures. Having a backup isn't enough — you have to show you can restore the data. Recovery tests must be documented.
4. Restores must happen "in a timely manner". The GDPR doesn't define a number of hours, but the national authority (ANSPDCP in Romania) may consider a recovery that takes weeks to be a breach.

What data must be protected, and for how long

Any data that identifies, or can identify, a natural person falls under the GDPR:

• Employee data: contracts, payroll, medical data, personal ID numbers (CNP)
• Data on individual clients: invoices, contracts, contact details
• Emails sent or received that contain personal data
• CRM, ERP or accounting databases with identifiable data

The retention period depends on the category of data and the applicable tax and employment law. In general, in Romania:

• Accounting documents: at least 5 years (Tax Code)
• Personnel files: at least 50 years for core documents
• Client data: for as long as there is a legal basis (active contract, legal obligation)

Fines and consequences of non-compliance

GDPR penalties have two tiers:

• Up to €10 million or 2% of global annual turnover — for technical breaches (including missing security measures such as backup)
• Up to €20 million or 4% of global annual turnover — for breaches of the core principles or of individuals' rights

Beyond fines, an incident involving the loss of client data obliges the company to notify the data protection authority within 72 hours, and to notify the people affected if the risk is high. The costs of notification, crisis management and reputational damage can sometimes exceed the fine itself.

How to comply in practice

GDPR compliance for backup means, in practice:

1. Automated daily backup of every system containing personal data
2. AES-256 encryption of backup copies — both on the local NAS and in the cloud
3. Offsite copies — a separate physical location or the cloud, for protection against local disasters
4. Monthly restore tests with documented results
5. A record of backup activities within the Record of Processing Activities (required by GDPR art. 30)

It doesn't have to be complex infrastructure. A Synology NAS with encrypted cloud backup and active monitoring covers all of these requirements for an SME with up to 50 employees.