GDPR & Data Retention for Ecommerce Backups
Ecommerce backup is not only an operational tool - it is a legal responsibility. The personal data stored in your backups falls under the same data protection regulations as your live store data, and the rules around how long you can keep it, what you must do when customers request deletion, and how you must respond if backup data is compromised are specific and binding.
For UK and EU-based ecommerce businesses, the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (UK GDPR) are the primary frameworks. Stores serving EU customers from outside the EU are also subject to GDPR. Getting gdpr ecommerce backup compliance right requires understanding how data retention law applies to the specific way backup data is stored, accessed, and managed.
This guide covers the GDPR requirements that directly affect your backup strategy - practically and accurately, without legal jargon, and with specific guidance for ecommerce operations. For the broader backup framework including tools and rollback, see Ecommerce Backup & Data Protection: Complete Guide.
See it in action
Want to automate this for your store?
VortexIQ's AI agents can audit, fix, and monitor your ecommerce store automatically.
Note: This guide provides general information on GDPR and UK GDPR as they apply to ecommerce backup. It is not legal advice. For specific compliance questions relevant to your business, consult a qualified data protection professional or your legal counsel.
In This Guide
Why GDPR Affects Your Backup Strategy
Many ecommerce teams understand that their live store data is subject to GDPR. Fewer understand that backup data is subject to exactly the same obligations.
GDPR does not distinguish between personal data in an active database and personal data in a backup archive. Both are "personal data" in legal terms. Both are your responsibility as the data controller. Both are subject to the rights of the individuals whose data they contain.
This creates three specific challenges for backup strategy:
The retention challenge. GDPR requires that personal data is kept only as long as necessary. Keeping backups indefinitely means keeping personal data indefinitely - which may exceed the period for which you have a lawful basis to retain it.
The erasure challenge. Customers have the right to request deletion of their personal data. Honouring this request in your live data is straightforward. Honouring it in your backup snapshots - which are point-in-time captures of your store at a specific moment - is technically complex.
The breach challenge. If your backup data is compromised (accessed by an unauthorised party), this constitutes a personal data breach subject to GDPR's notification requirements, even if your live store was not affected.
Understanding these challenges is the first step to building a backup strategy that is both operationally effective and data retention compliance ecommerce best practice.
What Personal Data Lives in Your Ecommerce Backup?
Before addressing compliance requirements, identify what personal data is actually captured in your ecommerce backup. This is more extensive than many stores realise.
Customer accounts:
- Customer names
- Email addresses
- Phone numbers
- Physical delivery addresses (home address, work address)
- Date of birth (if collected)
- Account login credentials (hashed passwords - still personal data)
Order history:
- Order contents and values
- Delivery addresses per order
- Payment method type (card type, last four digits - typically not full card numbers, which are not stored by ecommerce platforms)
- Shipping and fulfilment data
- Order notes (which may contain personal information added by customers)
Customer segments and tags:
- Customer tags (which may include behavioural or preference data)
- Segment memberships
- Loyalty programme data
Communication data:
- Marketing consent records and timestamps
- Email engagement data (if synced from your email platform)
- Customer service conversation records (if your helpdesk integrates with Shopify/BigCommerce)
Metafields:
- Any custom data stored in customer metafields (which may include personal information depending on your store's implementation)
This is a substantial body of personal data. A backup that captures all of it must be managed with the same care as your live database.
Data Retention: How Long Can You Keep Ecommerce Backups?
GDPR's storage limitation principle (Article 5(1)(e)) requires that personal data is kept "no longer than is necessary for the purposes for which the personal data are processed." This applies directly to backup data.
The challenge is that "necessary" is not a fixed period - it depends on the purpose for which the data was collected and is being retained. For ecommerce, different data types have different retention justifications:
Order data: Order records typically need to be retained for statutory accounting purposes. In the UK, companies are required to keep accounting records for at least 6 years from the end of the financial year they relate to. This provides a clear lawful basis for retaining order data, including associated personal data (customer name, address, order contents) for that period.
Customer account data: Personal data associated with a customer account (name, email, address) can be retained while the customer has an active account and a reasonable period afterwards. Once an account is closed or inactive for an extended period, the lawful basis for retention weakens.
Marketing data: Personal data processed for marketing purposes (email addresses in marketing lists, consent records) can only be retained while the processing is lawful - i.e., while valid consent exists or another lawful basis applies. Lapsed consent cannot retrospectively justify retention.
Backup snapshots containing all of the above:
Your backup snapshots capture everything at a point in time - including data where the retention period may vary. A snapshot from three years ago may contain customer account data for customers who have since requested deletion or whose retention period has expired.
A practical retention framework for backups:
Backup type Suggested retention Rationale Daily snapshots 90 days Operational recovery: most incidents are detected within 90 days Weekly snapshots 12 months Medium-term recovery and quarterly reference Monthly snapshots 3 years Annual reference, aligns with order data retention for VAT purposes Annual snapshots Consider carefully Only retain if you have clear purpose; personal data retention weakens over time
These are practical suggestions, not legal requirements. Your actual retention periods should be defined in your data retention policy with reference to the specific purposes for which you hold data. Consult your legal counsel or data protection officer for your specific situation.
The key principle: backup retention and data retention must be aligned. Your backup retention policy should reflect the same periods as your broader data retention policy.
The Right to Erasure and Backups
GDPR Article 17 gives individuals the right to request erasure of their personal data - the "right to be forgotten." This right is qualified (it applies when certain conditions are met, such as where consent is withdrawn or data is no longer necessary), but for ecommerce, where customer relationships often end and marketing consents lapse, it is a real and frequent obligation.
The challenge for backups: when a customer requests erasure, you can delete their data from your live store immediately. But that same data exists in every backup snapshot taken before the deletion. You cannot easily reach into a point-in-time snapshot and remove a specific customer's data without either rebuilding the snapshot (technically complex and potentially not cost-effective) or accepting that the backup contains data you are obligated to erase.
The ICO's position on backups and erasure:
The UK's Information Commissioner's Office (ICO) acknowledges that it is not always technically feasible to delete personal data from backup systems immediately. The ICO's guidance on the right to erasure indicates that a proportionate approach is acceptable: honour the erasure request in your live data immediately, document the request, and allow residual backup data to expire naturally when the backup is deleted as part of your normal retention schedule.
This approach requires three things:
- Immediate erasure in live data - the customer's account and associated data is deleted from your live store without delay
- Documentation - the erasure request and the date of live deletion are recorded
- Defined backup retention - your backups expire on a defined schedule (not retained indefinitely), so the residual backup data is deleted when the backup is deleted according to your policy
The critical requirement is that backup retention must be finite and documented. Indefinite backup retention makes the right to erasure practically unenforceable for backup data - which is a GDPR compliance problem.
Practical implementation:
In your privacy policy and data retention policy, document:
- How long backups are retained (your defined retention periods by backup type)
- That erasure requests are honoured in live data immediately
- That residual data in backup snapshots is deleted as backups expire on the normal retention schedule
This creates an auditable paper trail for erasure requests and demonstrates a proportionate, documented approach to backup data and the right to erasure.
Data Breach Notification and Backup Data
GDPR Article 33 requires notification to the supervisory authority (in the UK, the ICO; in EU member states, the relevant national DPA) within 72 hours of becoming aware of a personal data breach, where the breach is likely to result in a risk to individuals' rights and freedoms. The ICO's guidance on personal data breaches covers when and how to notify.
A personal data breach includes any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Your backup data is personal data. If backup data is compromised - accessed by an unauthorised party, lost, or exposed - this constitutes a personal data breach regardless of whether your live store was affected.
How backups can be involved in breaches:
- A backup tool with inadequate security is compromised, exposing backup data to an external party
- A backup stored in an unsecured location (unencrypted, publicly accessible storage) is accessed without authorisation
- A backup file is accidentally shared or transmitted to an incorrect recipient
- An employee with access to backup data leaves and access is not revoked
What the 72-hour requirement means in practice:
The 72-hour clock starts when you become aware of the breach - not when the breach occurred. "Aware" means when you have a reasonable degree of certainty that a breach has occurred, not when you have investigated and confirmed every detail.
For a backup-related breach, you should:
- Contain the breach immediately (revoke access, secure the affected backup data)
- Assess the scope (what data was potentially exposed, for how many individuals)
- Notify the ICO within 72 hours if the breach is likely to result in risk to individuals (if in doubt, notify)
- Document the breach, your assessment, and your response
Prevention through backup security:
The best approach to breach notification is not to need it. Backup data should be:
- Encrypted at rest - backup files are encrypted in storage so that access to the storage location alone does not expose readable personal data
- Encrypted in transit - data transferred to backup storage uses TLS/HTTPS
- Access-controlled - access to backup systems limited to team members who require it, with access logs
- Stored in an appropriate jurisdiction - UK/EU data residency for UK/EU customer data where possible, or with appropriate transfer mechanisms in place
For reference, VortexIQ's own approach to information security is documented in the VortexIQ Information Security Policy.
Building a Compliant Backup Policy
A compliant backup data retention policy documents your approach in writing, aligns with your broader data retention policy, and is applied consistently. This section provides a framework you can adapt.
Your backup data retention policy should define:
1. What is backed up.
List the data types captured: products, themes, pages, customers, orders, metafields, settings. This matches what your backup tool captures and should align with your data mapping / Records of Processing Activities (ROPA).
2. How frequently backups are taken.
Automated schedule (daily, weekly), on-demand triggers, retention of multiple snapshots.
3. How long backups are retained by type.
Define specific retention periods for different backup types (daily, weekly, monthly). Apply the principle of minimum necessary retention aligned to your operational needs and data retention obligations.
4. Where backups are stored.
Data location (UK/EU where applicable), security standards (encryption at rest and in transit), access controls.
5. Who can access backup data.
Defined list of roles (or individuals) with access to backup systems and the ability to initiate restores.
6. How erasure requests are handled in backups.
Document the approach: live data erased immediately, residual backup data deleted as backups expire on the defined retention schedule. Link to your erasure request log.
7. How breaches involving backup data are handled.
Reference your incident response and breach notification procedure.
8. Review cadence.
When is the backup policy reviewed? Who is responsible? Annual review is typical.
Where to store this policy:
Your data retention policy (or a backup-specific appendix to it) should be held internally as an operational document. It does not need to be public but should be available to your Data Protection Officer, legal counsel, or the ICO if requested.
How to Evaluate Backup Tools for GDPR Compliance
When selecting an ecommerce backup tool, assess it against these data protection ecommerce criteria:
Criteria Questions to Ask Data location Where is backup data stored? UK, EU, or elsewhere? Do they offer region-specific storage? Encryption Is data encrypted at rest? What encryption standard? Is data encrypted in transit? Access controls Can you control who has access to backup data and restore capability? Retention configuration Can you configure backup retention periods to match your data retention policy? Deletion capability Can you delete specific backups or all backups when required? (e.g., for erasure requests or policy changes) Data processing agreement Does the provider offer a Data Processing Agreement (DPA)? Under GDPR, a DPA is required with all processors of personal data on your behalf. Sub-processors Who are the provider's sub-processors? Are they disclosed? Are they in the UK/EU or operating under appropriate transfer mechanisms? Breach notification What is the provider's process for notifying you of a security incident affecting your data? GDPR/DPA compliance documentation Can they provide documentation of their own GDPR compliance (privacy policy, DPA, security certifications)?
Data Processing Agreement (DPA): A DPA is a legal requirement when you engage a third party to process personal data on your behalf. Your ecommerce backup provider is a data processor (they process your customers' personal data on your behalf). You must have a valid DPA with them. Reputable backup providers offer a standard DPA as part of their commercial terms. If a provider cannot provide a DPA, this is a red flag for GDPR compliance.
Vortex Apps is provided as part of VortexIQ's platform. For data protection documentation and DPA terms, see VortexIQ's Data Protection Addendum and Trust Centre, or contact the VortexIQ team directly.
Frequently Asked Questions
Does GDPR apply to the personal data in my ecommerce backups?
Yes. GDPR applies to all personal data you hold as a data controller, regardless of whether it is in a live database, a backup archive, a spreadsheet, or any other form. The obligations around lawful basis, data minimisation, storage limitation, data subject rights, and breach notification apply equally to backup data as to live data. The practical application differs (for example, the approach to erasure requests in backups has specific guidance from the ICO), but the legal obligations are the same.
How long should I keep ecommerce backup data under GDPR?
There is no single prescribed period - it depends on the purpose for which the data was collected and your specific data retention policy. Order data typically needs to be retained for statutory accounting purposes (6 years in the UK under Companies Act). Customer marketing data should be retained only while you have a valid basis for processing it. A practical approach for backups: define tiered retention (e.g., 90-day daily backups, 12-month weekly backups, 3-year monthly backups) in your data retention policy, and apply it consistently. The key requirement is that backup retention is finite and documented.
What happens to a customer's right to erasure if their data is in my backups?
Customers' right to erasure applies to backed-up data as well as live data. However, the ICO acknowledges that immediately deleting data from every backup snapshot is often technically impractical. The accepted approach is to honour the erasure request in your live data immediately, document the request, and allow the customer's residual data in backup snapshots to expire naturally when those backups are deleted according to your defined retention schedule. This requires that you have a defined backup retention period (not indefinite retention) and that you document erasure requests.
What is a Data Processing Agreement and do I need one with my backup provider?
A Data Processing Agreement (DPA) is a legally required contract between a data controller (you, the store owner) and a data processor (any third party processing personal data on your behalf). Your ecommerce backup provider processes your customers' personal data (by storing it in their backup infrastructure). Under GDPR Article 28, you must have a DPA in place with them. Reputable backup providers include a DPA as part of their commercial terms. If your current backup provider has not provided a DPA and cannot produce one, this is a GDPR compliance gap that should be addressed.
If my backup tool is compromised, do I have to notify the ICO?
If personal data in your backup system is subject to unauthorised access, loss, or disclosure - and if this breach is likely to result in a risk to the rights and freedoms of individuals - then yes, you must notify the ICO within 72 hours of becoming aware of the breach. The 72-hour requirement applies to the supervisory authority (ICO for UK-based businesses). If the breach is also likely to result in a high risk to individuals, you must also notify the affected individuals directly. Document the breach, your assessment, and your response regardless of whether notification is required.
Is it enough to delete customer data from my live store to comply with a right to erasure request?
For live data, yes - erasure must happen promptly when a valid request is received. For backup data, you must also have a documented approach and defined retention period so that residual backup data is deleted when backups expire. Simply deleting live data while retaining indefinite backups that contain the same personal data does not fully satisfy the right to erasure. The combination of immediate live deletion, documentation, and finite backup retention is the compliant approach.
Related Articles
- Ecommerce Backup & Data Protection: Complete Guide
- Disaster Recovery Plan for Online Stores
- Best Ecommerce Backup Tools 2026
- Ecommerce Backup & Rollback: Complete Protection Guide
Ready to take action?
Run a Free AI Audit on Your Store
VortexIQ scans your ecommerce store across 85+ checks — SEO, performance, analytics, ads — and gives you a prioritised fix plan in under 30 seconds.