Your backup shows green. What the GDPR and an insurer expect you to show

A backup console that says the last job succeeded tells you a copy was written. It does not tell you whether whatever breaks the original can reach the copy too, whether it covers every system the business depends on, or whether anything comes back out of it.

Centric Health is an Irish example. When ransomware hit the patient administration system of seven of its clinics in December 2019, its nightly backups and daily snapshots were hit as well: the Data Protection Commission found they were kept on the same physical server, not off site.

The National Cyber Security Centre's guide to ransomware says attackers focus on encrypting the backups they can access, to prevent recovery. The European Data Protection Board adds that ransomware can lie undiscovered for days, slowly encrypting rarely used data, which can make several backups in a row useless.

Article 32(1) requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the cost, the nature, scope, context and purposes of the processing, and the risk to people. Among the measures it lists, as appropriate, are these two, word for word:

Point (c) asks for an ability to restore, and Article 32 does not use the word backup. A copy that has never been restored shows that the copying ran, not that the ability exists. Point (d) is the testing, and it says regularly without saying how often.

Article 5(1)(f) requires protection against accidental loss, destruction or damage, and Article 5(2) requires the business responsible for the data (the controller) to be able to demonstrate it. A written record of a restore test is part of that demonstration.

The DPC's guidance note on data security calls a back-up system an essential means of recovering from the loss or destruction of data. Its frequency and nature depend on the organisation and the data, and the security standards for back-up data are the same as for live data. The duty to keep personal data secure applies to every controller and processor, regardless of size.

The EDPB's guidelines on breach examples go further on testing. Backup procedures should be structured, consistent and repeatable. Whatever the method, it should be tested to see that it works, both in what it covers and when data is to be restored. The testing should be repeated at intervals, especially when the processing changes.

The decision describes Centric Health as a provider of GP, dental and other services to over 400,000 patients across Ireland, with over 500 staff. On 3 December 2019 staff at seven of its clinics, in Kildare and Dublin, could not get into their patient administration system, and Centric's IT found malware that had encrypted patient data and demanded payment.

The records of about 70,000 patients were affected. Backups in cloud storage let data up to an earlier date be restored, but data from one period was gone: 2,500 patients were permanently affected because their data was deleted with no backup available. The DPC also found that steps Centric itself took in the immediate aftermath of the attack permanently deleted some of the data. Centric paid the ransom for a decryption key, which could not be applied because the data had been deleted in the meantime.

Centric told the DPC that no processes were in place to test restoration from backup for that server, and that it could not confirm when a restore had last been run. The DPC found no records of restore testing and no testing at regular intervals, so Centric was not in a position to know whether its backup data was intact or whether any restore would succeed.

The bar was set by what Centric held: health data, which the DPC said called for suitable and specific measures, including processes to test them. A GP, dental or other health practice holds the same kind of data. A business holding less sensitive data is measured against the risk of what it holds.

The decision, signed on 23 January 2023 (the DPC's decisions page gives 23 February 2023), found infringements of Articles 5(1)(f), 5(2) and 32(1), issued a reprimand, and fined Centric €275,000 under Article 5(1)(f), €50,000 under Article 5(2) and €135,000 under Article 32(1): €460,000 in all. The DPC had regard to the group's turnover in setting the fines.

The €50,000 under Article 5(2) was for records Centric could not produce, among them the patch assessments its own policy required and any document showing its security measures had been tested, assessed or evaluated. A restore test with no written record would leave the same gap.

The questions the DPC asked Centric about its backups make a good test of your own:

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data, among other things. The EDPB says ransomware can usually be classified as a breach of availability (you cannot get at the data), and often of confidentiality as well (someone else may have it).

Its guidelines work through four ransomware cases, set out below. The Board says a key variable in assessing the breach is how quickly data can be effectively restored from a readily available backup. Where the backup was encrypted along with the live data, it says that alone raises questions about the controller's security before the attack. In a well-designed backup regime, it says, multiple backups are stored where the main system cannot access them.

A backup does not settle the question on its own. In the first case the Board also relied on encryption at rest and on logs showing nothing had left the company. In the third, a backup that worked still left a high risk, because patients depended on the system while it was down.

If the breach has to be notified, the first 72 hours of a breach sets out what Article 33 requires; every breach, notified or not, must be documented under Article 33(5). The NCSC's ransomware guide adds that ransomware is a crime and should be reported to An Garda Síochána at a local Garda station, and that incidents may also be reported to the NCSC at incident@ncsc.gov.ie.

SME Cyber Resilience: Ireland's State of the Sector 2025 is a Munster Technological University (MTU) report, made in collaboration with the NCSC from data MTU collected. It found that 69% of the SMEs assessed operate without automated backup solutions. Among those with a backup schedule, only 32% test their backups more than once a year. The answers came from 894 organisations that used MTU's online assessment in 2024 and 2025, 88% of them micro businesses, and were self-reported and anonymous, with no independent auditing.

The NCSC's guidance and the EDPB's ransomware measures point to four things a backup should be.

Both providers keep deleted items for a time. The table gives each one's own documentation, read on 16 October 2026. The windows change, so check the pages before relying on a number.

The recycle bins, trash folders and restore windows get back something deleted recently. Each has an end date, and each is run from the same tenant and admin console as the live data.

The NCSC separates cloud storage, which keeps your files on the provider's servers, from a cloud back-up, which is a point-in-time copy you restore from. Its test is a copy not accessible through the same credentials (login details) as the primary data. Read against that test, none of the rows in the table is that copy, Microsoft 365 Backup included. Microsoft offers it through the Microsoft 365 admin center, says its backups never leave the Microsoft 365 data trust boundary, and lets the Backup tool's admin delete them. Neither provider says this. It is our reading of their pages against the NCSC's guidance.

One way to meet the test is a backup service outside the tenant, with its own login and second factor. Another is a regular export kept offline. The NCSC's questions for choosing a provider include where the data is stored, for example in the EU, and who has access to it. Ask the vendors of the accounts package, the booking system and the website what they keep, for how long, and whether you can take a copy out.

The backup is personal data like the original. A provider that stores it, or an IT provider that runs it, is your processor: under Article 28 its contract must require it to take the Article 32 measures and to make available the information needed to show it does. Ask it for the dated record of its last restore test, because Article 5(2) leaves the duty to demonstrate compliance with you. A copy stored in a third country brings in the transfer rules of Chapter V, which sending personal data to the US covers for the American case.

Chubb's Irish short proposal form for its Cyber Enterprise Risk Management policy (ROI0268-MD, 09/22) asks whether backups of mission-critical systems are immutable, completely offline or air-gapped, reached only through separate privileged accounts outside the standard Active Directory domain, or protected by multi-factor authentication. Its standard form (ROI0270-MD) asks whether full restores from backup are tested, whether recoverability and integrity are checked, and whether the restore plan includes ransomware scenarios.

OBF Insurance Group, a broker regulated by the Central Bank of Ireland, says underwriters expect encrypted backups, multiple copies across different media including one offline, and a restoration testing schedule. It says many underwriters will expect proof, and advises collecting screenshots, reports and evidence of configuration before you apply.

A yes on a proposal form is a statement about the business on the day it is signed. What the cyber insurance questionnaire asks covers answering it and the evidence folder to keep. The restore test below is that folder's entry for backups.

None of the texts above prescribes a method, so this is one way to run the test and leave a record that shows it was done. Take one system at a time.

How often is not in the law: Article 32(1)(d) says regularly. Chubb's standard form asks whether a formal disaster recovery plan covering cyber scenarios is tested annually, and the MTU figures counted backup testing more than once a year. Pick an interval that fits how fast your data changes, write it down, and keep to it.

NIS2 lists business continuity, such as backup management and disaster recovery, in Article 21(2)(c). But it covers only organisations classed as essential or important entities, and it is not yet Irish law. The deadline for transposing it was 17 October 2024. On 8 July 2026 the European Commission decided to refer Ireland to the Court of Justice for failing to notify transposition, and on 7 October 2026 the Government's National Cyber Security Strategy 2030 said a draft of the Bill was still being prepared. Where NIS2 stands in Ireland has the rest.

A business outside NIS2 that supplies one of those entities may still be asked about its backups, because Article 21(2)(d) makes supply chain security part of the entity's own measures. What a NIS2 customer asks its suppliers covers those questions.

The GDPR names no backup product, frequency or method. The 3-2-1 rule is the NCSC's guidance and one of the EDPB's examples, not a legal requirement. No standard or certificate is needed to meet Article 32 either; a customer asking for one is covered in CyFun, ISO 27001 or Cyber Essentials.