Cloud backup can support GDPR security and recovery requirements, but no provider label, certification, contract, or EU region setting makes every customer’s use compliant. The organization deciding why and how personal data is processed must assess its own processing, choose a processor that offers sufficient guarantees, and configure and test the service appropriately. Use the checks below to evaluate both the provider’s documented controls and your own setup.
Is cloud backup GDPR compliant?
It can be part of a GDPR-aligned processing arrangement, but “GDPR-compliant cloud backup” is not a universal provider status that transfers the customer’s responsibilities to the vendor. Under Article 28(1) of Regulation (EU) 2016/679, a controller must use processors that provide sufficient guarantees to implement appropriate technical and organisational measures. Article 32 requires security measures appropriate to the risk, considering factors such as the state of the art, implementation costs, and the context and purposes of processing.
As an Amazon Associate I earn from qualifying purchases.
The provider’s documentation helps you evaluate its services and contractual commitments. Your organization still needs to establish what personal data it backs up, why it does so, which service and settings it uses, who can access the data, how long copies remain, and whether recovery works for its needs. A data-processing addendum (DPA), certification, or provider statement is evidence to assess—not a blanket guarantee that your particular processing complies.
What GDPR requirements matter for backup?
Purpose and storage limitation
Article 5 requires personal data to be kept in identifiable form no longer than necessary for the purposes for which it is processed, subject to the regulation’s stated exceptions. It does not set one retention period for all backups. Set a period that you can explain in relation to your purposes and obligations, then check that the provider’s retention and deletion controls can implement it.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Security, availability, and recovery
Article 32 lists measures that may be appropriate depending on risk, including encryption or pseudonymisation, the ability to maintain confidentiality, integrity, availability and resilience, timely restoration after an incident, and regular testing and evaluation of security measures. It describes the restoration objective as “the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” (Regulation (EU) 2016/679, Article 32(1)(c).)
That requirement is about practical capability, not merely having backup copies. Define what timely restoration means for the systems and data at issue, decide who is responsible for each recovery action, and test whether a usable restore is possible.
International transfers
GDPR Chapter V governs transfers of personal data to third countries. The cited provisions do not impose a blanket rule that all personal data or backups must remain in the EU. A chosen storage region is relevant, but assess the broader data flow: backup copies and replicas, metadata, support access, and service-related transfers. Where a transfer is covered by Chapter V, identify the applicable transfer basis and safeguards rather than assuming that a regional setting settles the question.
Recommended Free Tools
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How to assess a cloud backup provider
Use the following questions as a due-diligence framework derived from GDPR Articles 5, 28, 32 and 44, provider documentation, and European Commission cloud-switching guidance. They are not a statutory checklist, and a feature’s necessity depends on your circumstances.
| Area | What to establish | Evidence or follow-up |
|---|---|---|
| Processor relationship | Who acts as controller, processor, and subprocessor for the specific service? Is the service covered by the current DPA and your documented instructions? | Review the DPA, service terms, subprocessor information, and applicable service documentation. |
| Geography and transfers | Where are primary copies, backups, replicas, and metadata stored? Where can support or service operations access or transfer data? | Map the data flow and check the transfer mechanism where Chapter V applies. Do not treat a region selector as a full transfer assessment. |
| Security and access | What encryption is available in transit and at rest? Who controls keys? How are user identities, least privilege, multifactor authentication, and access logging handled? | Match documented controls to your risks and responsibilities; determine which settings you must enable and operate. |
| Retention and deletion | Can the service implement a purpose-based retention schedule? How do expiry rules, deletion requests, immutable copies, and lifecycle settings interact? | Document the intended retention and confirm what deletion means for each copy and backup generation. |
| Restoration and resilience | Can you restore availability and access in a timely way after a physical or technical incident? | Define recovery procedures, responsible people, and tests that evaluate whether the measures work. |
| Exit and portability | Can data be exported or restored elsewhere in a usable format? What is the migration process and cost? | Review the provider’s exit process and test that the format and process meet your needs. |
How to configure and verify backup for your use
- Map the processing. List the personal data included, its purpose, the systems it comes from, and the people or services involved. Identify the controller, processor, and relevant subprocessors for the arrangement.
- Set a defensible retention schedule. Decide how long identifiable backup data is needed for its purpose and any applicable obligations. Record how the schedule applies to copies, replicas, and older generations. Do not substitute a generic number for this assessment: GDPR does not prescribe a universal backup-retention duration.
- Trace locations and transfers. Confirm where the service stores each kind of data and what may be accessed or transferred for support and service operations. If personal data is transferred to a third country, identify the applicable Chapter V mechanism and safeguards.
- Review the contract and service documents. Confirm that the current DPA and terms cover the particular backup service, and review subprocessor terms and the provider’s documented security controls. Resolve gaps between what the provider offers and what your organization must configure or manage.
- Apply access and security controls. Configure the protections appropriate to your risk, including encryption options, key management, individual accounts, least-privilege access, multifactor authentication, and logs where available and suitable. Confirm who operates each control instead of assuming it is enabled by default.
- Test recovery and review results. Exercise restoration using the procedures and access paths your organization would rely on during an incident. Evaluate whether data can be restored in the required time and whether the restored data is usable; adjust procedures or controls when tests expose a weakness.
- Check deletion and exit paths. Verify how retention expiry and deletion affect backup copies, including copies that cannot be changed immediately, and establish how data can be exported or moved if you leave the service.
What provider documentation does—and does not—show
AWS Backup and AWS GDPR information
AWS’s AWS Backup data-protection guidance recommends controls including protecting account credentials, using individual user accounts and least privilege, enabling multifactor authentication, using TLS, and applying encryption solutions. AWS also states that customers and partners acting as controllers or processors remain responsible for personal data they put in AWS under its shared-responsibility model.
AWS documents a GDPR Data Processing Addendum incorporated into its service terms. Its GDPR information says customers select AWS regions for customer data while describing circumstances in which data may be transferred outside a selected region, including service needs, law, or other stated exceptions. Treat region selection as one control to assess, not proof that every part of a data flow stays there. Verify the current terms, specific service, configuration, and region before relying on these documents.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Google Cloud Backup and DR
Google publishes Backup and DR-specific Data Processing and Security Terms addressing customer personal data, additional security controls, and adequate-country concepts. Confirm that the current document applies to the service and contract you plan to use. The terms alone do not establish the full behavior of a particular configuration or guarantee that it fits every customer’s processing.
These provider documents are useful inputs to due diligence; they are not a like-for-like comparison, hands-on test, endorsement, or determination that a customer’s setup is compliant.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does GDPR require backups to stay in the EU?
Not as a blanket rule established by the cited GDPR provisions. The relevant question is whether personal data is transferred to a third country and, if so, whether the applicable Chapter V conditions are met. Storage location is one part of that analysis. Also account for replicas, metadata, support access, and service operations, and use provider terms and data-flow information to identify where processing occurs.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For mixed datasets containing personal and non-personal data that are inextricably linked, the European Commission’s Your Europe guidance says the GDPR generally continues to apply. Do not assume that a dataset falls outside GDPR simply because it also contains non-personal information.
How long can cloud backups keep personal data?
There is no universal GDPR backup period in the cited provisions. Article 5’s storage-limitation principle ties the duration to the purpose for which identifiable personal data is processed, subject to the regulation’s stated exceptions. Choose and document a schedule for your processing, then check how the provider’s expiry, deletion, and any immutable-copy features implement it. A vendor’s default retention setting is not, by itself, a reason that the period is necessary for your purposes.
Plan for switching and incidents
Portability and recovery are operational concerns as well as provider-selection questions. The European Commission’s Your Europe guidance describes cloud switching and providers’ duties to provide data in a common machine-readable format. It states that switching and moving data out will be free from January 2027; because that date is future as of October 2026, check the current rule and its applicability when planning an exit.
Incident readiness also needs its own process. GDPR Article 33 sets a 72-hour deadline for a controller to notify a supervisory authority after becoming aware of a personal data breach where the notification rule applies and notification is feasible, unless the breach is unlikely to result in risk. That is a breach-notification deadline—not a backup retention period or a recovery-time target. A tested restore process supports resilience, but does not replace breach assessment or notification obligations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
