Data Protection Law in Data Recovery
By the HD Doctor Technical Team
Direct answer
Handing over HDD or backup with personal data to recovery vendor constitutes data sharing under data protection laws (LGPD, GDPR, CCPA). Without correct contract, your company can face fines up to 2-4% of turnover. See what to demand.
How data protection law affects recovery
When you send media with personal data (SSN, email, health, financial) for recovery, the vendor becomes a data processor under data protection law. Your company remains controller and keeps liability. Law (LGPD Art. 39, GDPR Art. 28) requires controller to choose processors offering adequate protection guarantee. Without correct documentation, an eventual leak during recovery makes your company liable first, not the vendor.
What to demand from a compliant vendor
- 1.Contract with specific personal data clause. Not generic. Clause must mention LGPD/GDPR by name, define processing purpose, retention period, return/destruction at end, obligation to notify incidents.
- 2.Appointed and identified DPO. Law requires processor to indicate data protection officer. Name, direct contact, authority. Without this, contractor has no one to talk to in incident.
- 3.Documented incident policy. Processor must have procedure to notify controller within 24h after detecting incident. Allows controller to meet 72h regulator deadline.
- 4.Documented physical and logical security. ISO 27001 or equivalent. Cameras in cleanroom. Fireproof safe. Logged access. Transit encryption for shipping.
- 5.Subprocessing policy. Processor CANNOT outsource to another processor without authorization. Sensitive data recovery must be 100% internal to the vendor.
- 6.Certified return or destruction. At contract end, media returns + internal copies are destroyed with certificate. Without this, your personal data remains in vendor cache.
FAQ
What if the case is personal, not corporate?
Data protection laws apply to personal data processing in general. For personal/family use, exceptions exist. But if you're a self-employed professional (doctor, lawyer, accountant) and HDD contains client/patient data, the law applies fully.
Can I sign a simplified agreement?
Technically yes for simple cases without sensitive data. But full contract is legal security in case of incident. HD Doctor provides free template contract for review.
Has a real fine been applied?
Yes. ANPD applied first fine in June 2023. GDPR has fined billions cumulatively since 2018. There's no more 'acclimation period' — fines have been active for years.
What about health data (hospital, clinic, forensics)?
Sensitive data has enhanced protection (LGPD Art. 11, GDPR Art. 9). Processing requires specific consent or specific legal basis. Recovery for hospital/clinic must use contract with additional clauses covering sensitive data.
Need a compliant contract?
HD Doctor template contract: data protection clauses + sensitive data + chain of custody.