How does the right to erasure apply to backups? A 2026 guide

Backups aren't exempt. Article 17 applies to every copy that still identifies the person, but European regulators accept that editing a backup isn't always advisable. What they expect then is a process: track each erasure request and apply it again to any backup you restore. Keeping backups out of everyday use and letting them expire on a short, written schedule makes that process easier to defend.

This guide explains the rules and the options. It isn't legal advice: for a procedure your company will rely on, ask your data protection officer or a lawyer.

The rules for backups at a glance

What regulators found in 2025

In 2025, 32 European data protection authorities ran a coordinated check of how controllers handle erasure requests, and 764 controllers answered their questionnaire. The European Data Protection Board adopted the report on 10 February 2026, and backups are one of its seven recurring problems.

Half of the authorities that responded raised concerns about deletion in backups. Many controllers had no specific procedure at all and relied on generic automatic deletion or a backup retention period. Many also left backup data out of scope by default, without giving a reason. One authority found that deleting data in increments spread over long periods made it hard to show that erasure happened "without undue delay".

The report also states the other side. Backups protect data integrity after incidents such as ransomware, so changing or deleting records inside them isn't always advisable. In that case the board expects you to keep track of erasure requests and honour them on restored systems. Its recommendations are to follow established standards for erasing data, and to check and be able to prove that erasure happened.

Three ways to handle a request in backups

Let backups expire, and replay deletions on restore

This is the common pattern. You delete the person from live systems at once, record the request in a deletion log that lives outside the backups, and let backups expire on their normal cycle. If you restore a backup before then, you run the deletion log against it before the system goes back into use.

It works only if the retention period is short and written down. A rolling 7-day or 30-day cycle is easy to explain. A yearly archive makes "without undue delay" much harder to argue.

Change the data inside the backup

Some controllers replace the personal data in backups with strings of random characters, which the EDPB report lists as a practice it observed. It keeps the backup's structure intact but means opening, editing and rewriting backup files, which many backup formats and write-once storage don't allow.

Encrypt per person and destroy the key

A design some teams use: encrypt each person's records with their own key, keep the keys outside the backups, and delete the key when an erasure request arrives. Every backup copy then holds data nobody can read. The EDPB report doesn't discuss this technique, so treat it as a measure to agree with your data protection officer, not as a settled answer.

What to check with your host

When a provider runs your database or stores your files, its backups are copies of your users' data. Ask for these in writing:

• Backup retention. How many days, weeks or months each backup is kept, and whether you can change it.
• What happens after you delete. Whether deleting a database, project or account also removes its backups, and when.
• Restore control. Whether you can run your deletion log before a restored copy goes live, or whether support restores for you.
• End of service. A delete-or-return clause under Article 28(3)(g) that names backups, and a contact for those instructions.
• Where copies sit. Which countries and subprocessors hold backups. See subprocessors explained.

How long managed databases keep backups

Platform	Default backups	Retention	After you delete the database
Clever Cloud PostgreSQL	Daily, free	7 days, changeable through support; no backups on the free DEV plan	Not stated
Scalingo PostgreSQL	Daily dumps, plus point-in-time recovery	7 daily backups; weekly kept 4 weeks on Starter, 8 weeks on Business; monthly kept 12 months on Business; point-in-time recovery 7 to 30 days by plan	Point-in-time data is removed; scheduled backups expire gradually; manual backups are kept 1 month on Starter, 1 year on Business
Exoscale PostgreSQL	Daily	2 days on Hobbyist, 3 on Startup, 15 on Business, 31 on Premium	Not stated
Eurobase	No managed Postgres	No fixed backup expiry is published	Deleting data doesn't by itself remove backups; the DPA covers delete or return at the end of service

Figures come from each provider's own page, checked on 10 November 2026.

Where Eurobase fits

Eurobase hosts web apps, containers, Functions and files on European infrastructure run by Scaleway, a French provider. The company is registered in Warsaw, Poland. It doesn't sell managed Postgres, MySQL or Redis, so most teams keep their main database with a provider like those above and use Eurobase for the app.

On backups, its legal pages are plain about the limits. The subprocessors page says deleting data from Eurobase's database doesn't by itself delete infrastructure logs, backups, repository-provider records or Stripe records. The DPA commits Eurobase to delete or return customer personal data at your choice when the service ends, but it doesn't yet name a date by which backup copies are gone. The terms give no backup guarantee unless a signed agreement says so. The privacy policy sets 30 days after recording as the point when project logs can be cleaned up. Eurobase doesn't hold ISO 27001 or SOC 2 yet; both are in progress.

Plans are Free, €10 a month or €20 a month + VAT. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving. If your users' data must be erasable from backups on a fixed timetable, keep it in a database whose backup retention you control, and keep your own deletion log.

A short erasure procedure

1. Find every place the person's data lives, using your record of processing: live databases, file storage, logs, analytics, email and backups.
2. Delete from live systems right away, and note any data an Article 17(3) exception requires you to keep.
3. Add the request to a deletion log stored separately from the backups.
4. Tell processors and other recipients under Article 19.
5. Let backups expire on their documented schedule, and replay the deletion log on any restore.
6. Reply to the person within one month, including how long backup copies remain and that they're out of normal use.

Frequently asked questions

Do I have to delete personal data from backups under GDPR?

The request covers backups, but you don't always have to edit them on the spot. The EDPB accepts that changing backups isn't always advisable, as long as you track the request and apply the erasure again if you restore. Keeping copies out of normal use and setting a defined retention period, so the copies disappear, makes the position easier to defend.

How long can backups keep data after an erasure request?

The GDPR gives no number of days. Article 17(1) requires erasure without undue delay, and the EDPB has said it may clarify what that means for backups. A short, documented cycle such as 7 or 30 days is easier to defend than a long archive.

What should I tell the person who asked for erasure?

Under Article 12(3) you reply within one month. Say what you deleted, which data you're keeping and under which exception, and that remaining backup copies are out of normal use and expire on a set date.

Does deleting my database at the host delete its backups?

Not always. Scalingo, for example, says scheduled backups expire gradually after a database is deleted, and manual backups are kept up to a year on Business plans. Ask your host, and use the end-of-service delete-or-return clause in its DPA.

Is pseudonymised data in a backup still personal data?

Treat it as personal data. The EDPB report found that some controllers answered erasure requests with basic pseudonymisation or partial masking, and said that doesn't meet the GDPR's requirements for deletion. Only data that no longer relates to an identifiable person counts as anonymous.

Sources

• GDPR Article 17, Article 12, Article 19, Article 5, Article 28 and Article 32
• EDPB: 2025 coordinated enforcement action on the right to erasure, report adopted 10 February 2026
• Clever Cloud PostgreSQL documentation
• Scalingo database backup policies
• Exoscale Managed PostgreSQL
• Eurobase DPA, subprocessors, terms, privacy policy retention, pricing, managed Postgres in Europe, GDPR hosting checklist and data processing agreement checklist