GDPR and backup: the documents your company needs for an audit in 2026

You know you need a backup — but if the data protection authority shows up tomorrow, do you have the documents to prove it? GDPR auditors don't just check that a backup exists. They check that it's organised, documented and tested in line with the Regulation's requirements.

Romanian companies are often surprised that a working backup system isn't enough if the written evidence is missing. This article covers the 4 documentation pillars a GDPR auditor checks and what each one has to contain.

If you'd like to understand the general legal obligations before the documentation, read: GDPR and backup: the concrete obligations your company has for data protection.

1. The record of processing (Art. 30) — the backup section

Article 30 of the GDPR requires every organisation that processes personal data to keep a record of its processing activities. Backup is a processing activity and must be recorded explicitly.

What the backup section of the record must contain:

• Purpose of processing: data recovery after an incident, operational continuity
• Categories of data included in the backup: employee data, client data, accounting documents, etc.
• Recipients of the data: the cloud storage provider (Wasabi, Backblaze B2), with its location and international transfers documented
• Retention periods: how many days/months backup versions are kept
• Technical security measures: AES-256 encryption, restricted access, 2FA authentication
• Person responsible: the person or role responsible for managing the backup

An incomplete Art. 30 record — one that mentions backup generically without these details — is one of the most common negative findings in data protection audits.

2. The backup policy — the minimum clauses it must contain

The backup policy is the internal document that describes how the company's backup system works. It doesn't need to be long — 2–4 pages is enough — but it has to cover:

• Backup frequency: automatic daily backup for critical data, weekly for archives
• Backup types: full, incremental, differential
• Storage locations: local NAS + offsite cloud (specific geographic location)
• Retention policy: how many versions are kept and for how long
• Encryption: the algorithm used, key management
• Access to the backup: who has access and through which authentication mechanism
• Restore procedure: documented steps for recovering data
• Responsibilities: who checks the backup daily, who escalates alerts

The policy must be formally approved by management (a signature or documented electronic approval) and reviewed at least once a year.

3. Restore test reports

This is the document auditors ask for most often and companies have least often. From a GDPR perspective, a backup that has never been restored is an unvalidated backup — and therefore an insufficient technical measure.

A restore test report must contain:

• The date of the test and who carried it out
• What data was restored (types, periods)
• How long the restore took (relevant for assessing RTO)
• The test result: full success / partial / failure (with details)
• Observations and corrective actions, if needed
• The signatures of the person responsible for IT and of a manager

Recommended minimum frequency: every 30 days for companies with sensitive data (medical, legal, accounting); every 90 days for lower-risk companies. BackupFirma packages include these reports automatically.

4. The incident response plan — the viable minimum for an SME

The incident response plan doesn't have to be a 50-page document. For an SME, 1–2 pages are enough if they cover:

• Trigger criteria: what a "security incident" means for your company
• The immediate first step: who is contacted in the first 30 minutes
• The assessment process: how you determine whether personal data has been compromised
• The procedure for notifying the data protection authority within 72 hours (form, contact, minimum content)
• The procedure for notifying affected individuals (if the risk is high)
• Responsibilities: who does what, with which contact details

Checklist: does your company have the GDPR documents for backup?

If you have fewer than 7 ticked, your company is exposed to a GDPR fine in the event of an incident or an audit. If you have fewer than 5, the risk is high even without an incident — an auditor can sanction missing technical and documentation measures without any breach having occurred.

What happens if documents are missing at an audit

The Romanian data protection authority (ANSPDCP) can open an investigation after a reported incident, on its own initiative or following a third-party complaint. Missing GDPR documentation for backup can lead to:

• A formal warning with a deadline to comply (the most common outcome for a first offence)
• An administrative fine between €1,000 and €100,000, depending on severity and the size of the organisation
• An obligation to undergo periodic audits at the organisation's expense
• Publication of the sanction on the ANSPDCP website — with significant reputational impact for companies that handle sensitive data

The documents aren't bureaucracy. They're proof that your company takes its responsibility for the data it handles seriously.