# Privacy and deletion

> What deleting your data really means, from the law to the backup tape.

- Page: https://tre-up.com/research/topics/privacy-and-deletion
- Topic 07 of 7 in [Research Notes](https://tre-up.com/research) · Last reviewed 2026-10-07

Deleting your data is a legal right in many places, but backups are usually erased on a schedule rather than instantly, and some are locked so no one can delete them early.

Destroying the encryption key for a person's data is a recognised way to make every copy unreadable at once. Fail-safe defaults, the idea that systems should fall to the safe side, run through this group.

## Questions in this topic

- [If I delete my data from an app, is it deleted from backups too?](https://tre-up.com/research/does-deleting-my-data-delete-it-from-backups): Eventually, but usually not at the same moment. EU and UK law require erasure without undue delay, and the UK regulator, the ICO, says backups count but may be put 'beyond use' until they are overwritten; Google Cloud commits to deleting customer data within about six months, and some backups are locked so that no one can delete them early. Markdown: https://tre-up.com/research/does-deleting-my-data-delete-it-from-backups.md

## What this topic rests on (15 sources)

- **The Protection of Information in Computer Systems**. Saltzer JH, Schroeder MD (1975). Proceedings of the IEEE 63(9):1278–1308. https://doi.org/10.1109/PROC.1975.9939
  - Institutions: Massachusetts Institute of Technology (United States)
  - Design: Design principles
  - What it found: The classic list of design principles for protecting information, including 'fail-safe defaults': when something goes wrong, a system should fall to the safe side, and access should be denied unless explicitly allowed.
  - Where the evidence stops: About computer security, not behaviour. We use it as an engineering principle, by analogy.
  - Our summary: https://tre-up.com/research/sources/saltzer-schroeder-1975-protection
- **General Data Protection Regulation, Article 17: Right to erasure**. European Union (2016). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
  - Primary document; jurisdiction: European Union
  - What it says: A company must erase personal data 'without undue delay' when, for example, it is no longer needed or consent is withdrawn. The article sets no day count and says nothing specific about backups.
  - Our summary: https://tre-up.com/research/sources/gdpr-article-17
- **General Data Protection Regulation, Article 12(3): Time limits for responding to requests**. European Union (2016). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
  - Primary document; jurisdiction: European Union
  - What it says: A company must tell a person what it did about their request, including an erasure request, without undue delay and within one month, extendable by two more months for complex cases.
  - Our summary: https://tre-up.com/research/sources/gdpr-article-12
- **Right to erasure (UK GDPR guidance)**. UK Information Commissioner's Office (current guidance). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/
  - Primary document; jurisdiction: United Kingdom
  - What it says: Erasure applies to backups too. If backup data cannot be overwritten at once, it must be put 'beyond use' until it is replaced on the normal schedule, and the person must be told clearly what will happen to their data.
  - Our summary: https://tre-up.com/research/sources/ico-right-to-erasure
- **Les durées de conservation des données (data retention periods)**. CNIL, French data protection authority (current guidance). https://www.cnil.fr/fr/passer-laction/les-durees-de-conservation-des-donnees
  - Primary document; jurisdiction: France
  - What it says: Describes a data life cycle from the active database to an isolated intermediate archive, kept only for legal obligations and open only to specifically authorised people. It sets no deadline for erasing backups.
  - Our summary: https://tre-up.com/research/sources/cnil-retention
- **Regulation on the Deletion, Destruction or Anonymization of Personal Data**. Turkish Personal Data Protection Authority (KVKK) (2017). https://www.resmigazete.gov.tr/eskiler/2017/10/20171028-10.htm
  - Primary document; jurisdiction: Türkiye
  - What it says: Deleted data must become inaccessible and unusable for the people who use it. Requests must be concluded within 30 days, and companies with a retention policy must run periodic destruction at least every six months.
  - Our summary: https://tre-up.com/research/sources/kvkk-deletion-regulation
- **App Store Review Guidelines 5.1.1(v): Account sign-in and deletion**. Apple (current guidelines). https://developer.apple.com/app-store/review/guidelines/#data-collection-and-storage
  - Primary document; jurisdiction: United States
  - What it says: An app that lets people create an account must also let them delete it from inside the app. Deactivating it is not enough.
  - Our summary: https://tre-up.com/research/sources/apple-guideline-5-1-1-v
- **Data deletion on Google Cloud**. Google Cloud (current documentation). https://docs.cloud.google.com/docs/security/deletion
  - Primary document; jurisdiction: United States
  - What it says: Deletion runs in stages: a recovery window of up to about 30 days, removal from active systems in about two months, then backups expiring on their normal cycles, with a commitment to delete customer data within about six months.
  - Our summary: https://tre-up.com/research/sources/google-cloud-data-deletion
- **SP 800-88 Rev. 2: Guidelines for Media Sanitization**. U.S. National Institute of Standards and Technology (2025). https://csrc.nist.gov/pubs/sp/800/88/r2/final
  - Primary document; jurisdiction: United States
  - What it says: Recognises 'cryptographic erase': destroying the keys that encrypt data, so every copy, including copies in backups, can no longer be read. It is far faster than wiping each copy.
  - Our summary: https://tre-up.com/research/sources/nist-sp-800-88-r2
- **Deleting an AWS KMS key**. Amazon Web Services (current documentation). https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
  - Primary document; jurisdiction: United States
  - What it says: Deleting an encryption key is irreversible: data encrypted under it can never be decrypted again. AWS enforces a waiting period of 7 to 30 days before the key is gone.
  - Our summary: https://tre-up.com/research/sources/aws-kms-key-deletion
- **AWS Backup Vault Lock**. Amazon Web Services (current documentation). https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html
  - Primary document; jurisdiction: United States
  - What it says: Locked backup vaults are write-once: in compliance mode no one, including AWS, can delete a backup before its retention period ends. Immediate deletion of such a backup is technically impossible.
  - Our summary: https://tre-up.com/research/sources/aws-backup-vault-lock
- **Locking objects with Object Lock**. Amazon Web Services (current documentation). https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
  - Primary document; jurisdiction: United States
  - What it says: In compliance mode, a locked object cannot be overwritten or deleted by any user, including the account owner, until its retention period ends.
  - Our summary: https://tre-up.com/research/sources/amazon-s3-object-lock
- **Soft delete for Azure Backup**. Microsoft (current documentation). https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature-cloud
  - Primary document; jurisdiction: United States
  - What it says: Deleted backup data stays recoverable for 14 days by default, extendable to 180. Microsoft is rolling out soft delete as always-on, so backups are not purged the moment they are deleted.
  - Our summary: https://tre-up.com/research/sources/azure-backup-soft-delete
- **Immutable vault for Azure Backup**. Microsoft (current documentation). https://learn.microsoft.com/en-us/azure/backup/backup-azure-immutable-vault-concept
  - Primary document; jurisdiction: United States
  - What it says: An immutable vault blocks any operation that would delete recovery points early. Once locked, immutability cannot be turned off.
  - Our summary: https://tre-up.com/research/sources/azure-immutable-vault
- **Guidelines 4/2019 on Article 25: Data Protection by Design and by Default**. European Data Protection Board (2020). https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201904_dataprotection_by_design_and_by_default_v2.0_en.pdf
  - Primary document; jurisdiction: European Union
  - What it says: Privacy has to be built into a product from the start and set as the default. On erasure, the guidelines ask that inaccurate data be erased or corrected without delay; they say nothing specific about backups.
  - Our summary: https://tre-up.com/research/sources/edpb-guidelines-4-2019

## Other topics

- [Timing and receptivity](https://tre-up.com/research/topics/timing-and-receptivity): When help lands, and when the same help is just noise.
- [Interruptions and attention](https://tre-up.com/research/topics/interruptions-and-attention): What a ping, a switch or an unfinished task costs the mind.
- [Engagement is not benefit](https://tre-up.com/research/topics/engagement-is-not-benefit): Why opening an app more often is not proof that it helps.
- [Autonomy and wording](https://tre-up.com/research/topics/autonomy-and-wording): Why people push back on advice, and the words that make it easier to hear.
- [Trust and uncertainty](https://tre-up.com/research/topics/trust-and-uncertainty): How people come to rely on automated advice, and how a system should admit what it doesn't know.
- [Learning a person](https://tre-up.com/research/topics/learning-a-person): How a system can help someone it barely knows yet, and why fresh answers beat old patterns.

---

© 2026 Tre-Up. You may read, link to, quote and summarise Research Notes, and search engines and AI assistants may index, summarise and cite them, as long as the source is credited with a link to the page on tre-up.com. Please do not present our notes as your own, or republish whole pages, without permission. Terms: https://tre-up.com/terms#use · About Tre-Up: https://tre-up.com/about