Deleting Customer Data When Old Backups Still Contain It

When a customer record has reached the end of its useful life, many businesses assume they either have to delete it instantly from every system or they can ignore old backup copies because backups are "just archives". Neither approach is safe. For an organisation covered by the Australian Privacy Principles, the question is whether personal information is still needed for a permitted purpose or must be kept under an Australian law or court or tribunal order. If the answer is no, you need to take reasonable steps to destroy the information or ensure it is de-identified, and that assessment extends to copies you hold, including archived and backup copies.

The hard part is that older backups, cloud snapshots and supplier-managed storage may not allow immediate selective deletion. That does not create a blanket exemption. It means you need a defensible process that maps where the data sits, separates live systems from difficult backup media, restricts access, and documents what will be destroyed and when.

The retention decision comes before backup disposal

Before focusing on backups, start with the main legal trigger. An organisation must take APP 11 reasonable steps to destroy personal information or ensure it is de-identified if it no longer needs the information for any purpose for which it may be used or disclosed under the Australian Privacy Principles.

That means the first decision is not technical. It is operational and legal:

• What was the information collected for?
• Do you still need it for that purpose?
• Is there another permitted purpose for which it may still be used or disclosed?
• Are you required by an Australian law or a court or tribunal order to keep it?

APP 11.2 also excepts personal information contained in a Commonwealth record. If a relevant statutory exception applies, the disposal duty does not apply on that basis. Otherwise, once no APP-permitted purpose remains, assess reasonable steps to destroy or de-identify the information.

This is where businesses often go wrong. A Data Retention Policy might say customer records are deleted after a set period, but the policy itself does not decide whether the law still allows or requires retention. The same is true in reverse. A Data Processing Agreement that says backups are retained for disaster recovery does not automatically justify keeping personal information longer than necessary.

A better approach is to create a short internal decision record for each category of customer data. For example, you might note that support tickets are no longer needed after the warranty period and no law requires continued retention, while some transaction records must be kept for a separate legal requirement. That record should be made before you decide what happens to backup copies.

Backups still count if you hold them

For organisations, the disposal obligation is not limited to the records sitting in the main application database. If you hold personal information that should be destroyed or de-identified, you must take reasonable steps in relation to all copies you hold, including archived copies and backups.

This is broader than physical possession. An organisation can hold personal information even when the data sits on another provider's infrastructure, if the organisation has the right or power to deal with it. That matters for common arrangements such as:

• cloud hosting environments
• software platforms with export or deletion controls
• managed backup services
• archived file stores controlled under your business account
• IT providers administering storage on your behalf

So if customer records are stored in a live system, replicated to a disaster recovery environment, copied into periodic snapshots, and then sent to a third party backup platform, your disposal assessment should cover each of those locations.

That does not mean every copy must always be erased immediately and individually. It does mean your business should be able to identify the copy types it holds and explain what reasonable steps are being taken for each one.

In practice, many businesses find it useful to separate their map into two groups:

• Current and accessible systems: production databases, CRM platforms, shared drives, active exports and working spreadsheets.
• Protected recovery copies: immutable backups, rotation media, snapshots and archived system images that exist for system recovery rather than ordinary access.

This distinction is practical, not a legal shortcut. The legal duty still applies across held copies. The difference is that the reasonable steps for a live CRM record may include prompt deletion, while the reasonable steps for a difficult backup copy may require a more limited and carefully controlled approach until destruction becomes possible.

What if you cannot selectively erase the backup copy?

This is where putting electronic records beyond use becomes important. If it is not possible to irretrievably destroy personal information held in electronic format, reasonable steps may include putting the information beyond use. But this is not a routine backup exception, and it is expected to apply only in very limited circumstances.

The threshold matters. It is not enough to say deletion would be inconvenient, time-consuming or costly. Those factors alone do not excuse destruction or de-identification. The question is whether, in all the circumstances, a particular step is unreasonable, and whether true technical limits prevent irretrievable destruction at that point.

An example may help. Suppose your backup software stores many customers' historical records inside encrypted monthly snapshots. Deleting one person's record from that snapshot would require destroying the whole snapshot, but the same snapshot also contains information the business is required to retain under an Australian law or a court or tribunal order. That is the sort of situation where immediate irretrievable destruction of that personal information may not be possible.

Even then, you do not automatically comply by leaving the backup alone. To treat the information as beyond use, every element of the standard needs attention.

The strict conditions for putting data beyond use

Personal information is beyond use only if the organisation satisfies all of the following conditions.

• The organisation is not able, and will not attempt, to use or disclose the personal information. The data cannot remain available for ordinary searching, analytics, support work or reactivation.
• The organisation cannot give any other entity access to the personal information. This includes contractors and service providers. If a supplier can restore or expose the data for routine business purposes, the condition may not be met.
• The organisation surrounds the personal information with appropriate technical, physical and organisational security. At a minimum, this should include access controls, logs and audit trails.
• The organisation commits to take reasonable steps to irretrievably destroy the personal information if, or when, this becomes possible. In other words, beyond use is an interim position, not a permanent parking spot.

These conditions are deliberately strict. They are meant for narrow cases where true destruction cannot currently occur, not for broad categories of stale data that a business simply has not cleaned up.

That is why a retention policy cannot replace the assessment. A policy might say backups are inaccessible after 30 days, but unless your business has actually prevented use and disclosure, controlled access, kept logs, and committed to later destruction, the policy wording alone does not answer the APP 11 question.

The same applies to technical labels. Encryption, account disablement or placing a file in cold storage may be sensible security measures, but none of them alone proves destruction, de-identification or beyond use.

What a workable deletion process looks like

For most small and growing businesses, the best process is one that matches legal assessment with system reality. The aim is to avoid over-promising instant erasure while still taking active steps across all held copies.

A practical process often includes the following stages.

1. Confirm the retention decision.

Record why the customer data is no longer needed, or identify the law or order that still requires retention. This avoids deleting data prematurely and avoids keeping it indefinitely by default.

2. Build a disposal map.

Identify where the personal information exists. Include live systems, reports, exports, shared folders, archived environments, snapshots and supplier-managed backups. Also note who controls each location and whether selective deletion is possible.

3. Delete or de-identify current-system copies first.

Where the data sits in production systems or other accessible repositories, deal with those copies directly. This is usually the clearest and most immediate step.

4. Assess hard-to-delete electronic copies separately.

For each backup or archive location, ask whether irretrievable destruction is presently possible. If it is, arrange it. If it is not, document the technical reason carefully and consider whether de-identification is appropriate or whether the narrow beyond use pathway applies.

5. Lock down recovery access.

If a backup copy must temporarily remain, make sure it cannot be used for ordinary business activity. Restrict restoration rights, require approvals, preserve logs and audit trails, and ensure staff and providers know the data is not to be used or disclosed.

6. Set an eventual destruction point.

Where data is only beyond use because selective deletion is not possible now, identify the event that will allow destruction later. That might be expiry of the backup rotation, retirement of storage media, or another technical point when the copy can be irretrievably destroyed without affecting information that must be retained.

7. Keep evidence.

Maintain internal notes of the assessment, system map, deletion actions, restrictions applied and supplier confirmations received. Evidence does not guarantee compliance, but it helps show that the business actively considered and implemented reasonable steps.

How to deal with cloud providers and other suppliers

Many businesses rely on vendors for hosting, backups and software storage. That does not remove the organisation's responsibility for personal information it holds through those arrangements.

If personal information is on a third party's hardware and you instruct that third party to irretrievably destroy or de-identify the information, reasonable steps include taking steps to verify that this has occurred. The same logic is useful for backup management more broadly: do not rely only on generic vendor language saying data is deleted according to policy. Ask questions that match your actual legal decision.

For example, you may want to confirm:

• which systems contain the customer data
• whether current-system deletion has occurred
• whether archived or backup copies remain
• whether selective deletion from those copies is technically possible
• who can restore or access those copies
• what controls, logs and approval processes apply
• when remaining copies will age out or be destroyed
• what record the supplier can provide of the action taken

This is not about forcing a particular certificate template. A supplier statement is useful only if it reflects the real storage setup and the action actually taken. A short, specific response explaining what was deleted, what remains in protected backups, and when residual copies will be destroyed is usually more valuable than a broad compliance assurance.

A simple example: deleting a former customer's records

Imagine a business has finished supplying services to a customer, the support period has ended, and no other permitted purpose remains. The business checks whether any law requires retention of some associated records. It finds that certain billing records must still be kept, but marketing notes and old support attachments do not need to be retained.

The business then:

• deletes the unnecessary customer data from its CRM and support platform
• removes exported spreadsheets from shared folders
• checks its cloud backup provider and learns the deleted records still exist within read-only weekly snapshots for a limited rotation period
• confirms those snapshots cannot be selectively edited without affecting other retained information
• checks whether it can actually satisfy every beyond-use condition, rather than merely limiting ordinary restore permissions
• does not call the data beyond use if it remains able to use or disclose it or give another entity access
• records when the relevant snapshots will rotate out and be irretrievably destroyed
• keeps the provider's written explanation and internal assessment on file

This is a disposal-planning example, not a conclusion that the snapshots comply. Restricted restore permissions alone do not satisfy the beyond-use conditions. If the business cannot meet every condition, it needs to assess another reasonable destruction or de-identification route with its technical team and legal adviser.

Frequently Asked Questions

Can we keep personal information in backups just because restoring it is unlikely?

No. Low likelihood of restoration is not enough by itself. You still need to assess whether the information is no longer needed, whether any legal retention requirement applies, and whether the backup copy can be destroyed, de-identified or only put beyond use in very limited circumstances.

Does de-identifying data solve the backup problem?

Sometimes, but only if de-identification is appropriate and the risk of re-identification is actively assessed and managed. Simply removing obvious identifiers or relying on a label from a software tool is not automatically enough.

Do we need proof from our supplier?

You should take sensible steps to verify that instructed destruction or de-identification has actually occurred on third party hardware. What is sensible will depend on the arrangement, but a meaningful record of what was done is better than a generic assurance.

Is there a fixed time by which all backups must be deleted?

No universal period applies across all businesses and systems. The key issues are whether the information is still needed, whether a law requires retention, what reasonable steps are available, and if beyond use is relied on, when destruction will become possible.

Key Takeaways

• For an APP-covered organisation, establish whether an APP-permitted purpose remains, and check Commonwealth-record or Australian-law/court-order retention exceptions.
• If not, take reasonable steps to destroy the information or ensure it is de-identified, and remember this extends to all copies you hold, including archived and backup copies and controlled supplier copies.
• There is no blanket backup exemption. Inconvenience, time or cost alone will not justify keeping redundant personal information.
• The beyond use option is narrow and only applies where destruction is not possible. You must prevent use and disclosure, prevent access by others, apply strong security with logs and audit trails, and commit to later irretrievable destruction when possible.
• A practical process should include a disposal map, live-system deletion, restricted recovery access for residual backups, eventual deletion commitments and records that verify what your suppliers have actually done.

If your business is reviewing a privacy policy, supplier terms, data retention settings or a customer data deletion workflow, Sprintlaw can help you put the legal position into a practical process. For help with privacy compliance, SaaS and cloud supplier contracts, data handling clauses and internal deletion procedures, contact Sprintlaw on 1800 730 617 or team@sprintlaw.com.au.