What is…
GDPR
The GDPR has applied directly in all EU member states since 25 May 2018. Several articles are particularly relevant for the technical infrastructure of data storage.
Art. 32 GDPR requires technical and organizational measures appropriate to the risk — including encryption of personal data, pseudonymization, and the ability to rapidly restore the availability, integrity and confidentiality of personal data after an incident. This directly establishes the need for robust backup infrastructure.
Art. 28 GDPR governs data processing agreements: every cloud provider acting as a data processor must be contractually bound. The controller remains responsible for compliance with all GDPR requirements — even when data is held by an external provider. This includes the question of whether the provider is subject to the US CLOUD Act.
Art. 17 GDPR (right to erasure) exists in tension with retention obligations (, HGB, medical records laws): retention obligations take precedence over the GDPR erasure obligation as long as they apply. After the retention period expires, the GDPR erasure obligation takes effect. Modern systems support deadline-based retention management that meets both requirements within a single system.
GoBD
The GoBD (Principles for the Proper Management and Storage of Books, Records and Documents in Electronic Form as well as Data Access) is a German Federal Ministry of Finance letter that specifies how tax-relevant documents must be archived electronically in Germany — particularly regarding immutability, completeness and auditability.
WORM
WORM (Write Once, Read Many) refers to a storage principle in which data is written once and can technically no longer be altered or deleted — in hardware WORM, this immutability is a physical property of the storage controller, independent of software, operating system or user privileges.