When a valid erasure request arrives, the UK regulator's guidance says you must also deal with backups, not just live systems. If the data cannot be overwritten at once, put it beyond use and be clear with the person about what happens. This is educational, not legal advice.
What the guidance says
The ICO's right to erasure guidance says you will have to take steps to ensure erasure from backup systems as well as live systems. Where a backup cannot be changed straight away, you should put the data "beyond use". It must not be used for any other purpose and stays until it is replaced under an established schedule.
It also says you should tell the individual what will happen, including that data may remain in the backup environment until it is overwritten. The guidance notes the risk may be low depending on context. EU and other regimes differ, so ask counsel about yours.
What beyond use looks like in practice
Engineers can make the idea real:
- A short, fixed backup retention, so every copy ages out on a known date.
- A restore procedure that re-applies the deletion list after any restore.
- Access controls so only the restore process touches backups, not analytics or support.
- A log of erasure requests kept apart from the data they refer to.
The second point matters most. If you restore last month's backup, deleted people reappear unless you replay the deletions. Keep a tombstone list and run it as a step in every restore runbook.
Retention length is a privacy decision
Long retention helps recovery and hurts erasure. Thirty days of backups means a deletion is fully gone in about thirty days. Seven years means it is not. Choose retention with both goals in view, and write the reason down. For a worked approach, see building a data retention schedule.
Cryptographic erasure is another option for some designs: encrypt each customer's data with its own key and delete the key. It adds complexity, and you must still manage the keys safely. See crypto-shredding explained.
What to tell the requester
Say plainly that live data is deleted now, that backup copies expire on a stated schedule, and that backups are not used for anything else in the meantime. Avoid promising instant deletion everywhere unless it is true.
Quick check
Do I have to rewrite old backups for one deletion request?
The ICO guidance describes putting the data beyond use and letting it be overwritten on the normal schedule, rather than requiring an immediate rewrite. Confirm for your jurisdiction.
What breaks if I restore an old backup?
Deleted records can come back. Keep a list of erasures and reapply it after every restore.
Sources
Last reviewed: 19 October 2026.
