Overview
A deletion request does not end at the production system. Backups, archives, and photocopies are copies too — and GDPR asks you to know where they are, what you can delete, and what you must keep.
Where the copies hide
The production database is the easy part. The same personal data sits in nightly backups, email attachments, shared drives, archive tiers, paper files, and the laptop of someone who left. Copies too is not a metaphor; it is the scope of the request. A records inventory that stops at the database is a map of the wrong territory.
Erasure is not the same as deletion. Deleting a row or a file may leave the data in a backup, a replica, or a search index. The obligation is to erase personal data without undue delay, subject to lawful exceptions. The clock starts when the request is received, not when the archive team responds.
You cannot answer a request from a data map that only covers systems of record. The map has to include the copies the business actually uses. Paper is still a copy; so is the scan of the paper.
- Production — the system of record.
- Backups and archives — retention copies.
- Paper and endpoints — the copies outside the platform.
Erasure, retention, and legal hold
The right to erasure is not absolute. Legal obligations, legal claims, public-interest tasks, and freedom of expression can justify retention. The answer is a documented balancing test, not a blanket policy. Document the exception, the reviewer, and the date; an undocumented exception is indistinguishable from a missed request. The European Commission GDPR guidance is a useful reference for the legal test.
Retention and erasure must be designed together. A retention schedule that ignores erasure is a hoard; an erasure process that ignores retention is a liability. The schedule should say what happens to backups and archives, not only to the live system.
Legal hold overrides deletion for specific records and custodians. It must be scoped, acknowledged, and released with evidence, or the hold becomes a permanent archive. A hold that nobody can find is not a hold.
- Request — identity, scope, and lawful basis.
- Exception — which retention or claim applies.
- Hold — what must not be deleted.
- Release — when normal disposition resumes.
What you can actually delete
Backups are not a loophole. If the backup is immutable, document the retention period and the restore path; if a restore would reintroduce erased data, the restore process needs a deletion step. Test a restore before you promise erasure, not after.
Crypto-shredding can make data unreadable by destroying the key, but it is only credible if key custody and rotation are documented. A backup is not a loophole; it is a copy with its own lifecycle. Key custody is the control; the algorithm is not.
Archives and paper need the same treatment: an inventory, a retention rule, a destruction method, and a certificate. The evidence matters as much as the deletion. A certificate with no system name is a receipt for a rumour.
- Backup — retention, restore, re-deletion.
- Archive — retention class and destruction.
- Paper — secure destruction and certificate.
- Index — remove derived copies and embeddings.
A practical matrix
List each copy type, its retention, the erasure method, and the evidence you can produce. The matrix is the difference between a policy and an operation. The matrix should fit on one page; if it needs a workshop, it is not operational.
For each row, name the owner and the system of record. If two systems disagree about retention, the stricter lawful rule wins until counsel resolves it. Escalate disagreement to counsel before the request, not during it.
Test one request end to end: find every copy, apply exceptions, erase what you can, and record what remains. Record the residual copies and the reason they remain.
- Production — delete/anonymize, audit log.
- Backup — retention, restore test, re-delete.
- Archive — schedule, destruction certificate.
- Paper — chain of destruction, certificate.
Checklist before the next request
Pick one data subject and one document class. Walk the copies. If you cannot find the copy, you cannot erase it. The test is not whether the primary record disappears; it is whether the copies do.
- Inventory — every copy and owner.
- Basis — erasure, retention, or hold.
- Method — delete, anonymize, crypto-shred.
- Evidence — what was erased, what remains, why.
GDPR compliance is not a delete button; it is a documented path through copies, exceptions, and evidence. Start with the systems that hold personal data outside the record, then test one request. If backups and archives are part of your document program, request a demo and bring one erasure scenario. For the broader GDPR guide, see GDPR and personal data in documents; for retention and hold, see records retention and legal hold; for tracking, see document tracking that proves custody. The regulator will ask for the path, not the promise.