When should data backup copies be deleted?

ANSWER

With regard to data backup copies, when determining the retention period the controller's business profile and the scope of data stored on the backups should be taken into account. Backup copies may be made daily, weekly, or monthly. Each of these options is possible and correct; it is for the data controller to determine the frequency of backups. The most commonly recommended retention period for personal data on backup copies is two months. However, it should be borne in mind that it may be necessary to delete backups earlier, for example in the absence of a legal basis for processing certain data or upon receipt of a request for erasure of personal data from the data subject. As a general rule, all backup copies should be deleted upon the expiry of the retention period determined by the controller or when the legal basis for processing the personal data expires, or when the data subject submits a request for erasure of their personal data.