Wissen dat de back-up niet bereikt
Een op verzoek gewist gegeven blijft in de back-up staan en komt bij een herstel weer in het systeem terug.
- Familie
- Bewaring
- Status
- actief
- Geldt voor
- backend
Wat er gebeurt
The erasure is carried out in the live system. Backups made before it keep the record and nothing marks it as erased. When a backup is restored, in part or in whole, the record comes back, and from that moment it is live again: indexed, exported, included in the next backup. Where no register of erasures is kept, the restore cannot even be corrected afterwards, because nobody knows what was supposed to be gone.
Waarom het ertoe doet
The person was told the data was gone. It was not, and the moment it returns has nothing to do with anything they can see or ask about. The same holds for scheduled deletion: a record removed on time reappears from a backup whose cycle is longer than the period it was meant to enforce.
Veelvoorkomende oorzaken
- erasure implemented as a delete in the application, with backups outside the scope of the procedure
- no register of erasures, so a restore cannot re-apply what was erased
- a backup cycle longer than the retention period it is supposed to serve
- test and analysis environments refreshed from the same backup
Dit is het níet
A record kept too long in the live system is an ordinary retention finding. This entry is about the second copy: the live system is right and the store behind it is not. A log holding content is Logs recording content, not events, where the fault is what gets written rather than what fails to be removed.
Hoe je het vaststelt
Indicator
The organisation's own answer states either that backups are out of scope for erasure, or that no register of erasures exists from which a restore could be corrected. In a system you administer yourself the behavioural check settles it directly: a record erased on request is present again after a restore, with no re-application step in between.
Methode
document-comparison
Kwaliteit van de detectie
75 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- A register of erasures is kept and re-applied after every restore, and the procedure names who does it.met de hand te toetsende bevinding vervalt
- Backups are encrypted per record with a key destroyed at erasure.met de hand te toetsende bevinding vervaltThe restore then returns something nobody can read, which is a defensible implementation of erasure.
- Backup retention is shorter than the period after which the record would have been deleted anyway.met de hand te toetsende bevinding wordt zwakker
- The erasure request was refused on a stated ground, so nothing had to be erased.met de hand te toetsende bevinding vervalt
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Juridisch kader
Bepalingen
Veelgehoorde tegenwerpingen
A backup cannot be edited, that is what makes it a backup.
Nobody asks for it to be edited. What is asked is that the erasure survives a restore, which a register applied on restore achieves without touching the backup at all.
The backup is only for disaster recovery.
Then the disaster is the day the erased record comes back. What the copy is for does not change what happens when it is used.
We keep no register of erasures, for privacy reasons.
A list of identifiers with a date is less data than the records it stops from returning, and it is the only way the promise can be kept.
It is a rare edge case.
It is measurable rather than rare: the backup cycle and the number of restores per year are both known inside the organisation.
Geldt wanneer
to-processing