Your data rights
Erasure and Backups: Is Your Data Really Deleted?
When an organisation agrees to erase your personal data, copies in its backups often do not vanish on the same day. Here is what "deleted" really means under the UK GDPR, why backups are treated differently, and what you can reasonably expect.
In short
When an organisation erases your personal data, copies usually remain in its backups for a while. Under the UK GDPR, the ICO accepts that backups can be put "beyond use" — isolated and protected from active use — until the backup is overwritten on its normal cycle, rather than deleted instantly. Live data goes; backups expire over time.
What "deleted" usually means in practice
When an organisation acts on a right-to-erasure request under the UK GDPR (Article 17), most people picture every copy of their data disappearing in one clean sweep. The reality is more layered. Organisations typically hold your data in two broad places: live, active systems that staff use day to day, and backup copies kept in case those live systems fail or data is lost.
Erasing data from the live system is the part you usually notice — your record is removed from the database the organisation works in. Backups are different. They are snapshots taken at points in time, often stored separately and designed not to be edited, precisely so they remain a reliable safety net. Reaching into a backup to surgically remove one person's record can be technically difficult and can even undermine the integrity of the backup itself.
So when an organisation tells you your data has been deleted, it generally means it has been removed from active use. The backup copies may still exist for a period afterwards. This is general information, not legal advice.
Why backups are treated differently — the "beyond use" approach
The UK's data-protection regulator, the Information Commissioner's Office (ICO), recognises this practical difficulty. Its guidance accepts that where data is held in a backup, an organisation does not always have to delete it from that backup immediately to honour an erasure request. Instead, it can put the backup data "beyond use".
Putting data beyond use means the organisation isolates it so it is not used for any other purpose, protects it appropriately, and commits to deleting it when the backup is next refreshed or overwritten on its normal cycle. In other words, the backup copy is parked safely and left to expire as the backup ages out, rather than being reached into and edited. The ICO's position is that an organisation taking this approach can be considered to be meeting its erasure obligations, provided it does not bring that data back into active use in the meantime.
This is why a faithful answer to "is my data really deleted?" is often: yes from live systems now, and from backups within the organisation's backup retention period. The exact timing depends on how long that organisation keeps its backups before overwriting them.
- Live data: removed from the systems staff actively use, usually first.
- Backup data: isolated and put beyond use, then deleted as backups are overwritten.
- Beyond use means: not used for anything else, protected, and scheduled to expire.
- Timing: tied to the organisation's normal backup cycle, not the day you asked.
What you can reasonably expect, and ask
Knowing how backups work helps you set realistic expectations and frame a clearer request. If full erasure matters to you, it is reasonable to ask an organisation to confirm that your data has been removed from live systems and that any remaining backup copies have been put beyond use and will not be reused. Many organisations will explain their backup retention period if you ask.
It also helps to remember the limits of what anyone can promise. An organisation may lawfully keep some data even after an erasure request — for example where it has a legal obligation to retain certain records — and erasure does not apply in every situation. Because the decision and the technical reality both sit with whoever holds your data, no one can guarantee that every trace disappears on a particular date. A calm, specific request and a record of the reply put you in the strongest position.
OSINTA's role here is to help you understand your own footprint and frame and route your own requests; the choices remain yours at every step. If you are not satisfied with how an organisation handles your erasure request, you have the right to complain to the ICO. This is general information, not legal advice.
Frequently asked questions
If a company deletes my data, is it gone from their backups too?
Not immediately, in most cases. The company usually removes your data from its live, active systems first. Copies in its backups typically remain until those backups are overwritten on their normal cycle. The ICO accepts that, in the meantime, the company can put the backup data "beyond use" — isolating it and not using it for anything else — rather than deleting it from the backup straight away.
What does "beyond use" mean?
It is the ICO's term for backup data that an organisation has isolated so it cannot be used for any other purpose, has protected appropriately, and has committed to delete when the backup is next refreshed or overwritten. Treating backup copies this way is generally accepted as meeting erasure obligations, provided the data is not brought back into active use.
How long until my data is removed from backups?
It depends on the organisation's backup retention period — how long it keeps each backup before overwriting it. There is no single fixed deadline for backups, unlike the one calendar month that usually applies to responding to your request. Many organisations will tell you their retention period if you ask.
Can I insist my data is wiped from every backup right now?
You can ask, but an organisation does not have to delete data from a backup immediately to meet an erasure request if it puts that data beyond use until the backup expires. It may also lawfully keep some data where it has a valid reason, such as a legal duty to retain records. Because of this, no one can guarantee instant removal from every copy. This is general information, not legal advice.
Related terms
This is general information, not legal advice. For guidance on your own situation, consider speaking with a qualified professional.
Reviewed by OSINTA's founding lawyer — 2026-06-27.
Want to understand what is held about you first?
OSINTA helps you see your own digital footprint and frame and route your own data-rights requests — you stay in control of every step.