undefined | Better HN

johnbellone8y ago

You would keep a list of unique identifiers (opaque) that were deleted and filter data out prior to rewriting/restoring it. It’s cumbersome but not impossible.

colejohnson668y ago

So I need to keep a list of people to delete from my backups when I restore them? Is keeping that list even GDPR compliant?

1 more reply

berti8y ago

So you then need to make sure that dataset is at least as resilient as your cold backups. That's not exactly a trivial problem in most cases.

ww5208y ago

So basically more work.

1 more reply

daveFNbuckOP8y ago

You need backups of which information needs to be deleted. Or you can just store PII separately from the rest of your data so most of your backups don't need to be modified.

philjohn8y ago

How long are you keeping backups in cold storage for - usually you'd want maybe 6 months there, but no more, otherwise it's just going to grow unbounded and become a financial burden.

contravariant8y ago

That's certainly a valid point, but it still doesn't solve the problem of having to remember to delete something in the event of data loss.

As far as I can tell to comply with a deletion request with absolute certainty requires infallible storage (which would remove the need for backups) or modifying backups (which contradicts the concept of a backup). Maybe you can claim 'force majeure' at some point, but perfect compliance seems impossible.

1 more reply

0 comments

0 comments