Backup Retention Erasure

[For each data category in the retention schedule]
         │
         ▼
[What is the retention period?]
         │
         ▼
[Is this data included in backup sets that are retained longer than the retention period?]
   │
   ├── No ──► Compliant — backup rotation will delete data before or at retention expiry
   │
   └── Yes ──► COMPLIANCE GAP
               │
               ├── Option A: Exclude this data category from long-retention backup sets
               │     (segregate data by retention tier; back up separately)
               │
               ├── Option B: Reduce backup retention to match the shortest data category
               │     (may conflict with business continuity requirements)
               │
               └── Option C: Accept interim retention in backups with protective measures
                     (document "beyond use" controls; delete at next rotation)
                     MAXIMUM acceptable overshoot: 90 days beyond retention period

PROCEDURE: RESTORE-AND-DELETE
Organization: Orion Data Vault Corp
Procedure ID: BKP-RAD-001

TRIGGER: Art. 17 erasure request where data exists only in backups
         and backup rotation will not occur within an acceptable timeframe

PREREQUISITES:
- All primary system deletion confirmed complete
- Backup system granular deletion confirmed infeasible
- DPO has approved restore-and-delete approach
- Next backup rotation > 90 days away

PROCEDURE:

Step 1: Identify Relevant Backup Sets
   - Query backup catalog for sets containing data subject's data
   - List all relevant backup sets with dates and storage locations
   - Estimated effort: [hours/days]

Step 2: Provision Isolated Restore Environment
   - Create isolated network segment (no connectivity to production)
   - Provision temporary storage sufficient for backup restoration
   - Apply access controls (authorized personnel only)
   - Enable full audit logging

Step 3: Restore Backup to Isolated Environment
   - Restore the backup set(s) to the isolated environment
   - Verify restoration integrity (checksum validation)

Step 4: Execute Granular Deletion
   - Identify and delete the data subject's records from the restored data
   - Verify deletion (query for data subject's identifiers — zero results expected)

Step 5: Create Replacement Backup
   - Export the cleaned data as a replacement backup set
   - Verify replacement backup integrity
   - Store replacement backup in the same tier as the original

Step 6: Destroy Original Backup
   - Delete or overwrite the original backup set containing the data subject's data
   - If tape: degauss and destroy the original tape
   - If disk: secure overwrite of original backup files
   - Generate destruction confirmation

Step 7: Decommission Restore Environment
   - Securely wipe the isolated restore environment
   - Release temporary storage
   - Disable the isolated network segment

Step 8: Documentation
   - Record all steps in the deletion confirmation record
   - Update the data subject's erasure request file with backup deletion confirmation
   - Log total time and resources consumed (for future planning)

ESTIMATED TIMELINE: 5-15 business days depending on backup size
ESTIMATED COST: [Track for each execution — informs cost-benefit analysis]

[Disaster Recovery Event — Backup Restoration Required]
         │
         ▼
[Select Appropriate Backup Set for Restoration]
         │
         ▼
[Check: Does this backup pre-date any completed erasure requests or retention expiry deletions?]
   │
   ├── No ──► [Restore normally — no erasure compliance action needed]
   │
   └── Yes ──► [Retrieve Suppression List]
               │
               ▼
         [Restore backup to production environment]
               │
               ▼
         [IMMEDIATELY execute deletion of all records matching suppression list]
               │
               ├── Automated: Run deletion script against suppression list
               │   (pre-built script must exist — test quarterly)
               │
               └── Manual (if automated script fails): Assign to data team
                   with 24-hour SLA for completion
               │
               ▼
         [Verify deletion — zero records for suppressed data subjects]
               │
               ▼
         [Log re-deletion event in erasure confirmation records]
               │
               ▼
         [Resume normal operations]