Manage backups of your public records

Backups of entire systems and information in case of failure are usually done for disaster recovery or business continuity purposes.

Recordkeeping considerations

Your public authority's IT team will make and manage backups. You may need to ensure that:

• backups can be used to restore some or all of your public records
• individual public records can be extracted
• backups are managed appropriately, kept for as long as necessary and disposed correctly.

You may need to consider:

• the backup cycle (e.g. daily, weekly or monthly)
• whether backups are incremental, full or a combination of both depending on when it's done
• how critical the information being backed up is and how often it is changed in the application
• how often backups are tested to ensure that the system can be recovered from the backups
• how long backups are kept
• whether your IT team knows how to extract individual public records from the backup.

It may be necessary to have multiple backups in multiple locations. While this can make it difficult to dispose of data, it may be necessary if a location or backup fails.

Dispose of backups

Backups can be disposed of after business action completed under the General Retention and Disposal Schedule. You and your public authority's IT team will need to decide when that is.

Backups are not a recordkeeping system

Backups are not recordkeeping systems and should only be used for business continuity and disaster preparedness purposes. This is because they:

• save all your data as one collection of information or as an entire system — this makes it difficult to find information and manage retention periods
• are usually unable to ensure public records remain accessible, usable and managed for the entire time you need to keep the public records
• don't usually keep or maintain any of the metadata associated with the public records
• use proprietary storage software meaning you need to pay to maintain access to your backups
• increase the risks to your public records and information the longer you keep them, particularly if vendors change or go out of business
• are at risk of technological obsolescence if they rely on specific software or hardware.

More information

The Information Security Policy includes information on backup requirements and the appropriate disposal of media.

Determine what you need to do to sentence and dispose of public records, including backups.