Physical Disconnection And UK GDPR

UK GDPR Article 32 requires appropriate technical and organisational measures, including the ability to ensure ongoing confidentiality, integrity and availability, and the ability to restore availability and access to personal data in a timely manner after an incident. Article 5(1)(f) adds the integrity and confidentiality principle. The ICO expects controllers to consider the state of the art. Logical isolation reduces exposure, but a copy that remains addressable on a network remains within reach of a compromised credential. This paper is a technical argument, not legal advice.

Each line below is something an assessor, regulator or underwriter can ask you to evidence.

Logical isolation (VLANs, firewalls, object lock) is enforced by software that can be misconfigured or bypassed

An immutable bucket is still reachable over an API with valid credentials

Physical disconnection removes the network path entirely while offline

Availability after an incident depends on a copy the attacker could not reach

Confidentiality improves when exfiltration has no route to the data

Evidence of the disconnected state is simpler to prove than a policy configuration

What happens when the control is missing, and the record cannot be produced.

Always Addressable

Anything with an IP address can be scanned, targeted and eventually reached.

Credential Compromise

Stolen administrator or cloud console credentials can change retention, delete or exfiltrate.

Configuration Drift

Firewall rules and bucket policies change over time, often without the data owner knowing.

Exfiltration Path

A logically isolated copy can still be copied out, creating a reportable personal data breach.

Offline Secure Storage® holds personal data on dedicated hardware in the customer's chosen jurisdiction, physically disconnected between identity-verified windows.

Integrity And Confidentiality

With no network interface while offline, there is no remote path to alter, encrypt or exfiltrate the copy.

Timely Restore (Art. 32(1)(c))

Scheduled restore windows return a clean copy after ransomware, supporting availability duties.

Hardware Encryption At Rest

Data is encrypted on dedicated hardware, with identity factors held by the customer.

Jurisdiction Chosen By You

Bunkers across Europe including the UK, so international transfer questions are answered by design.

Regular Testing (Art. 32(1)(d))

Recurring verification windows test and evaluate the effectiveness of the measure.

Accountability Evidence

Every connection, identity check and restore is logged to support Article 5(2) accountability.

The records most often moved into Offline Secure Storage® for this framework.

HR and payroll records

Client and patient records

Legal case files

Customer databases

CCTV and identity documents

Backups of production systems

Alongside, not instead of

Physical disconnection complements encryption, access control and immutable backups. It provides the copy of last resort.

Aligned with NCSC

The NCSC advises keeping at least one backup offline. Physical disconnection turns that advice into a provable state.

Easier breach assessment

If the offline copy had no network path during an incident, it is simpler to show it was not affected.

Not legal advice

Controllers remain responsible for their own risk assessment. Firevault supplies the architecture and the evidence.

Tell us which framework you are being tested against.

We will map Offline Secure Storage® to the outcomes your assessor is checking, and give you the wording and evidence to submit.

From £360 a month including VAT. 36-month commitment. First payment at checkout.