Article 12: Backup policies and procedures, restoration and recovery procedures and methods
Article 12 requires financial entities to maintain backup policies and procedures that set the scope of data subject to backup and the minimum backup frequency based on data criticality or confidentiality, plus restoration and recovery procedures and methods, tested periodically. For each function, the recovery time objective (RTO) and recovery point objective (RPO) must be set with regard to whether the function is critical or important and the potential impact on market efficiency.
Chapter II, ICT risk management · Pillar: ICT Risk Management
Key points
- Backup scope and minimum frequency scale with data criticality and confidentiality
- Restoration and recovery procedures and methods must be tested periodically
- RTO and RPO are set per function, weighing criticality and market-efficiency impact
- For entities other than microenterprises, restoration should use ICT systems physically and logically segregated from the source system
How this fits DORA
Article 12 sits within the ICT Risk Management pillar. For the full set of obligations and how they interlock, see the DORA requirements overview.
Read the official text
This is an editorial summary. Read the binding text of Article 12 in the consolidated regulation on EUR-Lex.