# If I delete my data from an app, is it deleted from backups too? > Eventually, but usually not at the same moment. EU and UK law require erasure without undue delay, and the UK regulator, the ICO, says backups count but may be put 'beyond use' until they are overwritten; Google Cloud commits to deleting customer data within about six months, and some backups are locked so that no one can delete them early. - Page: https://tre-up.com/research/does-deleting-my-data-delete-it-from-backups - Topic: [Privacy and deletion](https://tre-up.com/research/topics/privacy-and-deletion) - Published 2026-10-07 · Updated 2026-10-10 · 11 sources - Written by Pursue Lab, Tre-Up's research process (https://tre-up.com/research/method) - Cite as: Pursue Lab, Tre-Up (2026). If I delete my data from an app, is it deleted from backups too? https://tre-up.com/research/does-deleting-my-data-delete-it-from-backups ## What the law requires Under the GDPR, a company must erase personal data 'without undue delay' when, for example, consent is withdrawn; the article sets no day count and does not mention backups [1]. It must tell you what it did within one month, extendable by two months for complex cases [2]. The UK regulator is explicit that erasure covers backups, and that data which can't be overwritten at once must be put 'beyond use' until it is, with the person told clearly what will happen [3]. In Türkiye, requests must be concluded within 30 days, and companies with a retention policy must destroy data at least every six months [4]. On iPhone, apps that let you create an account must let you delete it inside the app [5]. ## How backups actually work Google Cloud describes a staged process that ends with a commitment to delete customer data within about six months, as backups expire on their normal cycles [6]. Microsoft keeps deleted backups recoverable for 14 days by default [7]. Some backups are deliberately locked: AWS and Microsoft offer write-once storage that no one, not even the provider, can delete before its retention period ends [8] [9]. There is a cleaner way: encrypt each person's data with its own key and destroy the key. NIST recognises this 'cryptographic erase', and once a key is gone, data encrypted under it can never be read again, in every copy [10] [11]. ## What this is not This is a summary of public rules and documentation, not legal advice. Laws and provider practices change, and how a rule applies to a particular company is a question for a lawyer. ## Something to try today Before you trust an app with personal data, look for two answers in its privacy policy: how long backups are kept after you delete your account, and whether it sells data in any form, including 'anonymous' or pooled. ## How Tre-Up approaches this Tre-Up's policy is that it does not sell your data, not personal, not anonymous, not pooled. Our working design, still a hypothesis, is to stop all use of your data the moment you delete it, purge backups on a stated schedule, and move toward a key per person so deletion reaches every copy. Tre-Up is an iOS app in development. Pursue is the AI inside it. This note describes research and design intent, not results from the app. Nothing here is medical advice. ## Sources Summaries are written in our own words from each source's abstract, public record or official text. Follow the link to read the original. 1. European Union (2016). General Data Protection Regulation, Article 17: Right to erasure. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 - Our summary: https://tre-up.com/research/sources/gdpr-article-17 2. European Union (2016). General Data Protection Regulation, Article 12(3): Time limits for responding to requests. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 - Our summary: https://tre-up.com/research/sources/gdpr-article-12 3. UK Information Commissioner's Office (current guidance). Right to erasure (UK GDPR guidance). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/ - Our summary: https://tre-up.com/research/sources/ico-right-to-erasure 4. Turkish Personal Data Protection Authority (KVKK) (2017). Regulation on the Deletion, Destruction or Anonymization of Personal Data. https://www.resmigazete.gov.tr/eskiler/2017/10/20171028-10.htm - Our summary: https://tre-up.com/research/sources/kvkk-deletion-regulation 5. Apple (current guidelines). App Store Review Guidelines 5.1.1(v): Account sign-in and deletion. https://developer.apple.com/app-store/review/guidelines/#data-collection-and-storage - Our summary: https://tre-up.com/research/sources/apple-guideline-5-1-1-v 6. Google Cloud (current documentation). Data deletion on Google Cloud. https://docs.cloud.google.com/docs/security/deletion - Our summary: https://tre-up.com/research/sources/google-cloud-data-deletion 7. Microsoft (current documentation). Soft delete for Azure Backup. https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature-cloud - Our summary: https://tre-up.com/research/sources/azure-backup-soft-delete 8. Amazon Web Services (current documentation). AWS Backup Vault Lock. https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html - Our summary: https://tre-up.com/research/sources/aws-backup-vault-lock 9. Microsoft (current documentation). Immutable vault for Azure Backup. https://learn.microsoft.com/en-us/azure/backup/backup-azure-immutable-vault-concept - Our summary: https://tre-up.com/research/sources/azure-immutable-vault 10. U.S. National Institute of Standards and Technology (2025). SP 800-88 Rev. 2: Guidelines for Media Sanitization. https://csrc.nist.gov/pubs/sp/800/88/r2/final - Our summary: https://tre-up.com/research/sources/nist-sp-800-88-r2 11. Amazon Web Services (current documentation). Deleting an AWS KMS key. https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html - Our summary: https://tre-up.com/research/sources/aws-kms-key-deletion ## Related notes - [Is there an app that notices when my day is slipping and suggests one next step?](https://tre-up.com/research/is-there-an-app-that-notices-when-my-day-is-slipping.md) --- © 2026 Tre-Up. You may read, link to, quote and summarise Research Notes, and search engines and AI assistants may index, summarise and cite them, as long as the source is credited with a link to the page on tre-up.com. Please do not present our notes as your own, or republish whole pages, without permission. Terms: https://tre-up.com/terms#use · About Tre-Up: https://tre-up.com/about