Question

A data subject in the EU submits a valid GDPR Article 17 (right to erasure) request to an online retailer that operates entirely on a public cloud SaaS platform. The privacy officer confirms the request is legitimate and that no legal exemption to retain the data applies. When the DPO instructs the operations team to comply, the team reports that the customer's personal data also exists in encrypted incremental backups that are retained on a 90-day rolling cycle and cannot be selectively edited without corrupting the backup chain. What is the MOST appropriate way to handle the erasure obligation with respect to these backups?

Accepted Answer

Erase the data from production systems now, and document a defensible process ensuring the backup copies are put beyond use and destroyed on the normal rolling retention cycle

Answer

Immediately restore, delete the record, and re-create every backup so the data is purged from all retained copies at once

Answer

Deny the erasure request because immutable backups qualify as a technical impossibility exemption under GDPR

Answer

Transfer the backups to the cloud provider so that erasure becomes the provider's sole responsibility as data controller