Data Backup
A separate copy of data kept so that processing can continue after loss, ransomware or a failure.
A data backup is a separate copy of your data kept safe so that you can recover it after a ransomware attack, an accidental deletion or a system failure.
Meaning of Data Backup
Rule 6 asks for reasonable measures for continued processing in the event of loss or compromise, such as backups. A backup that is never tested, or that is stored on the same system, offers little protection. Backups also contain personal data, so they must follow retention and erasure rules.
A backup copies data at a point in time to a different location or medium, so that if the original is lost, damaged or locked by criminals, the organisation can restore it. Common approaches include full backups, incremental backups that copy only changes, snapshots of cloud systems, and offline or immutable copies that cannot be altered once written. A frequently quoted guide is the 3-2-1 approach: three copies, on two kinds of storage, one kept off-site.
Rule 6 of the DPDP Rules 2025 requires reasonable measures for continued processing in the event of a compromise of the confidentiality, integrity or availability of personal data, such as by way of data backups. This forms part of reasonable security safeguards under Section 8(5) of the Act. The security triad matters here: confidentiality is about who sees data, integrity about whether it is accurate and unaltered, and availability about whether it can be used when needed.
Backups serve the availability and integrity limbs. They help a fiduciary meet the duty in Section 8(3) to keep data complete and accurate where it is used for decisions, and let it keep serving people after an attack. A backup is not a security measure for confidentiality by itself, because a copy of personal data is another place from which it can leak, and it must be protected as carefully as the original.
Backups raise questions of retention and erasure. If a customer asks for erasure under Section 12, or if a fiduciary must erase data when the purpose is over under Section 8(7), copies in backup do not disappear automatically. Organisations commonly handle this through short backup cycles, restoration rules that re-apply deletions, and encryption with key destruction, and should document the approach. Sector regulators such as RBI also set expectations on business continuity and disaster recovery.
Examples of Data Backup
A company keeps encrypted daily backups in a separate location and restores one every quarter to confirm it works.
A company hit by ransomware restores its customer ledgers from an offline backup taken the previous night. Because the backup was encrypted and tested, it is back online in a day without paying a ransom.
A hospital keeps daily copies of its patient system in a second city. A quarterly drill shows that restoring the radiology archive takes three days, so the hospital adds capacity to cut it to eight hours.
A start-up backs up its database to the same cloud account. When an employee's credentials are stolen, the attacker deletes both the live data and the backups, which leads the start-up to move copies to a separate, locked account.
Why Data Backup matters
Ransomware gangs now target backups first. A company with no clean copy faces a choice between paying criminals and losing records, which can mean medical histories, loan files or exam results gone for good. Loss of availability also harms individuals directly, for instance when a hospital cannot access allergy records or a bank cannot show a customer her balance.
From the compliance side, missing or untested backups weaken the claim that safeguards were reasonable, which carries a ceiling of ₹250 crore. A backup stored unencrypted on the same network can create a second breach, so poor backup practice can increase the damage it was meant to reduce.
How it works in practice
- 1Identify the systems and data that matter most, and set targets for how much data you can afford to lose and how quickly you must be running again.
- 2Follow the 3-2-1 approach, with at least one copy offline or immutable, and keep backup accounts separate from daily administrator accounts and protected by multi-factor authentication.
- 3Encrypt backups in transit and at rest, manage the keys separately, and apply the same access control and logging as for live data.
- 4Test restoration on a schedule, for example every quarter, and record the time taken and any failures.
- 5Define how long backups are kept, and how deletion and erasure requests are reflected when a backup is restored, and delete expired copies securely.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Never testing restores: many organisations discover only during a crisis that the backup is incomplete or unreadable.
Storing backups on the same network or account as the live system, where an attacker can reach both.
Leaving backups unencrypted and loosely controlled: they hold the same personal data as the original.
Ignoring backups when handling erasure and retention: deleted data can return after a restore if no process reapplies deletions.
Compliance tips
Write down recovery time and recovery point targets with the business owners, and test against them.
Keep an offline or immutable copy of the most critical data.
Include backup providers in your processor contracts and review their security terms.
Common questions about Data Backup
Does the DPDP Act require data backups?
Rule 6 expects reasonable measures for continued processing if personal data is compromised, such as backups. It does not prescribe a method, so the design should match the risk and the importance of the data.
Are backups covered by the right to erasure?
Backups hold personal data too. A fiduciary should have a documented approach, such as short backup cycles and reapplying deletions on restore, so that erased data does not reappear in use.
How often should I test backups?
The Rules set no frequency. A common practice is to run a restoration test at least quarterly for critical systems, and after major changes, and to record the results.
Is a backup a good defence against ransomware?
It is one of the best, provided a clean copy is separate from the network, protected and tested. Attackers often seek backups first, so isolation and immutability matter.