Mr. Seamus Carroll:

There is no distinction whatever drawn in the GDPR between personal data and backed up personal data and the obligation on data controllers is similar in relation to both current data being used and backed up data. Under existing law, there is a specific provision in relation to backup data but that distinction between current data and backed up data does not appear in the General Data Protection Regulation.