In short
Microsoft 365 backup compliance in the UK means treating backups as personal data under UK GDPR: securing them, keeping them no longer than needed, handling erasure requests, knowing where they are stored and having processor terms with the backup vendor. A tested backup also supports the UK GDPR requirement to restore access to personal data after an incident.
Get a quote for Microsoft 365 backup compliance
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Backups are personal data
Your mailboxes, OneDrive files and SharePoint sites are full of personal data, so a backup of them is too. The UK GDPR applies to the copy just as it does to the original. The articles most relevant to a Microsoft 365 backup are:
| UK GDPR provision | What it says, in short | What it means for backup |
|---|---|---|
| Article 5(1)(e): storage limitation | Personal data is kept in an identifiable form for no longer than necessary | Set backup retention deliberately, including for leavers, rather than keeping everything indefinitely by default |
| Article 5(1)(f): integrity and confidentiality | Appropriate security, including protection against accidental loss | Encrypt backups, limit who can access and restore them, and protect the console with MFA |
| Article 17: right to erasure | In some circumstances people can ask for their data to be erased | Agree with your DPO how erasure requests are handled for backup copies, and record them so erased data is not restored back into live systems |
| Article 28: processors | Controllers use processors that give sufficient guarantees, under a written contract | The backup vendor acts as a processor, and so may we if we manage the service for you; check the data processing terms |
| Article 32: security of processing | Includes, where appropriate, the ability to restore the availability of and access to personal data in a timely manner after an incident, and regular testing | A tested backup is direct evidence for this requirement |
| Article 33: breach notification | Report a personal data breach to the regulator without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk | Loss of access to data, as well as theft, can be a breach; backups and their logs help you assess it |
We describe these considerations rather than give legal advice. Your data protection officer, or whoever holds that role, should decide how they apply to you.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Choosing where your backup is stored
Where the backup copy is held matters for UK GDPR, because transfers of personal data outside the UK need appropriate safeguards under Chapter V, and because many customer contracts and public-sector buyers ask for UK storage. What we know about each option today:
| Option | Storage location |
|---|---|
| Microsoft 365 Backup | Microsoft says backups stay within the Microsoft 365 data trust boundary and respect your tenant's data residency |
| Commvault | Commvault's documentation lists a UK region for Microsoft 365 workloads |
| Redstor | You choose the storage region; Redstor lists UK storage sites in Reading, Slough, Hoddesdon and Gloucester |
| Axcient x360Cloud | Stored in the Axcient Cloud; we confirm the location with you before you order |
| NinjaOne SaaS Backup | The vendor lists the United Kingdom among its data centre regions; the region is chosen when the account is set up |
| Acronis | Depends on the Acronis Cloud location chosen when the account is created; confirmed at quote |
Ask for the storage location in writing as part of your quote, and record it in your records of processing. The Microsoft 365 backup comparison covers the other differences between these platforms.
NCSC guidance
The NCSC is the UK's technical authority for cyber security, and two pieces of its guidance are directly relevant:
- Principles for ransomware-resistant cloud backups (November 2024): five principles covering resilience to destructive actions, continued customer access, restoring from earlier versions, key management and alerts. Our immutable Microsoft 365 backup page explains each one
- Small Business Guide: the NCSC's guide for smaller organisations includes backing up your data among its basic steps, which is a useful starting point if you do not have a dedicated IT team
NCSC guidance is not law, but it is what auditors, insurers and public-sector buyers tend to measure you against, and following it is a reasonable way to show your security measures are appropriate.
Is Microsoft 365 backup compliance the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Cyber Essentials, insurance and audits
Cyber Essentials. Backup is not one of the five Cyber Essentials technical controls (firewalls, secure configuration, security update management, user access control and malware protection), so it is not what the assessment checks. It is still good practice, and many organisations working towards Cyber Essentials review backups at the same time. See the Cyber Essentials requirements for what is assessed.
Cyber insurance. Proposal forms set their own questions, so read yours. They may ask whether backups are taken, how often, whether they are held separately from the production environment, whether they are protected from deletion and whether restores are tested. A backup held outside your Microsoft 365 tenant, with separate credentials and a record of test restores, gives you clear answers.
Audits and customer questionnaires. Expect questions on scope (which workloads and mailboxes are covered), retention, location, encryption, who can restore and when you last tested. Keeping a short written record of your setup makes these quick to answer.
Backup is not record-keeping
Backups and records management solve different problems, and regulators tend to ask about the second:
| Backup | Retention and archiving | |
|---|---|---|
| Purpose | Get data back after loss, corruption or attack | Keep records for a required period and find them on request |
| Typical tools | Third-party backup, Microsoft 365 Backup | Microsoft Purview retention policies, litigation hold, email archiving |
| Search and legal holds | Basic search; built for restore | Built for eDiscovery, legal hold and subject access requests |
If you must keep email for a set period, respond to subject access requests or place staff on legal hold, use the right tool for that job. Our Microsoft 365 retention policy and Microsoft 365 backup vs retention pages explain Microsoft's side, and our sister site covers email retention policy, UK GDPR email retention, legal hold and subject access requests.
A compliance checklist for your Microsoft 365 backup
These questions cover most of what a DPO, auditor or insurer will ask. Answer them in writing and keep the answers with your records of processing:
- Which workloads are backed up: Exchange Online (including shared, group and archive mailboxes), OneDrive, SharePoint, Teams and Entra ID?
- Where is the backup stored, and does any data leave the UK? If so, what safeguard covers the transfer?
- Which processors are involved (the backup vendor and your supplier), and are data processing terms in place with each?
- How long are backups kept, for current staff and for leavers, and why is that period justified?
- How are erasure requests handled for backed-up data?
- How are backups protected: encryption, immutability or delayed deletion, separate credentials and MFA on the console?
- Who can restore data, and who can delete backups or change retention? Are alerts set for those actions?
- When was a restore last tested, what was restored and did it work?
The Microsoft 365 backup best practices checklist turns several of these into practical settings.
How we help
We can document what your Microsoft 365 backup covers, where it is stored, how long it keeps data and who can restore it, which is usually what an auditor, insurer or customer wants to see. If you are choosing a backup, we confirm the storage location and processor terms at quote, set retention with your DPO's input and record a test restore. Pricing depends on users, storage and retention, so ask us for a quote.
Contact us about Microsoft 365 backup and compliance.
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
Is Microsoft 365 backup required for GDPR?
UK GDPR does not name backup products, but Article 32 includes, where appropriate, the ability to restore the availability of and access to personal data in a timely manner after an incident, and regular testing of security measures. A tested backup is one of the clearest ways to show that. Check your own position with your DPO.
Where is Microsoft 365 backup data stored?
It depends on the product. Microsoft says Microsoft 365 Backup stays within the Microsoft 365 data trust boundary and respects your tenant's data residency. Commvault, Redstor and NinjaOne SaaS Backup all list UK storage regions, and for Acronis and Axcient x360Cloud the location is confirmed at quote. Ask for it in writing.
How do erasure requests apply to backups?
Backups contain personal data, so the right to erasure can apply to them. It is often impractical to edit a backup, so agree an approach with your DPO, for example recording the request so the data is not restored back into live systems, and let retention remove it in time.
Is backup part of Cyber Essentials?
No. The five Cyber Essentials technical controls are firewalls, secure configuration, security update management, user access control and malware protection. Backup is not assessed, though it remains good practice and is often asked about by insurers and customers.
Is a backup the same as an archive for compliance?
No. A backup is built to restore data after loss. An archive or retention policy is built to keep records for a set period and find them for eDiscovery, legal hold or subject access requests. Many organisations need both.
Still have a question about Microsoft 365 backup compliance?
Ask us and a member of our team will reply by email.