Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Under HIPAA and some privacy laws (in US, EU and other countries), the user has the right to amend (under some laws even delete) his/her data. What is the right way to handle a request to amend/delete regarding archived data or backups? That data may not be in use today but it may be accessed in the future.

share|improve this question
up vote 1 down vote accepted

I can only speak for the UK; here the end consumer (or the subject of the data) has a right to enforce that an organisation (a data processor) keeps up to date information about the subject. The act does not make any special provision for backups etc

if old data is accessed from time to time then it is the responsibility of the organisation (data processor) to ensure that the data is matched against the most recent data before utilising it.

Why would you sometimes access old data (except during a disaster)?

share|improve this answer
Thanks for your answer. I think then the only data to be modified is data in use, not data at rest (unless data at rest become data in use, as in a backup restore). – MV. Jan 17 '13 at 11:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.