GDPR and Backup Documentation – Must Every Security Measure Be Documented?
ANSWER
Yes, all security measures implemented within an organisation — including, for example, the creation of backups — should be appropriately documented.
In accordance with the accountability principle under GDPR (Article 5(2)), the data controller must be able to demonstrate compliance with the Regulation, including with Article 32 GDPR concerning the security of processing.
Documentation of the technical and organisational measures applied, such as backups, encryption, access controls, and system monitoring, is essential during an inspection by the supervisory authority.
A lack of documentation may be treated as evidence that adequate measures have not been implemented, even if those measures are in fact operational in practice.
