Does deletion have to reach backups and test copies?

Short answer: Yes, through a written backup-expiry rule

Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.

What the law says

Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down.

Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.

Steps

List where copies live: backups, replicas, test, analytics, laptops, vendors.
Set backup retention to match the retention schedule.
Write a rule: deleted records are not restored into live systems.
Mask personal data in test and training copies.
Get deletion confirmations from vendors.

Evidence to keep

Backup retention settings
Written backup-expiry rule
Masking procedure for test data

Common mistakes

Ten-year backups for convenience
Live copies in test
Restoring old backups and bringing deleted records back

How it plays out by sector

Banking, financial services and insurance: Core banking backups often run for years. Match backup retention to the record schedule.
IT, ITeS, BPO and GCC: Client backups held by managed service teams must follow client retention.
Central government: ministries and departments: Backups of scheme systems must be offline or immutable against ransomware.
Public sector undertakings and utilities: Backups of billing and ticketing systems follow retention.
Healthcare and hospitals: Offline backups decide whether care continues during ransomware.

From each seat

CISO / Security head: Test a full restore, not a file restore. Then check that backup retention does not quietly keep deleted records for years.
CIO / IT head: Deletion is an engineering task. Decide how each system deletes, how backups expire, and how test copies are masked.
IT department: Write the backup-expiry rule and mask test data. These two steps close most deletion gaps.
Procurement department: Add an exit clause: data returned or deleted, with a certificate.

What a good answer from management sounds like

“Backups expire on a written cycle, test systems use masked data, and restored backups are cleaned before use.” Effort and time: Medium · 6 to 10 weeks.