united-kingdom criminal-law gdpr
Old backups containing login information
<p>I've been keeping an old website backup of a website that I used to work on on my PC for the last year or so. It was all my own work and wanted to just keep it in case I ever wanted to reuse it or use it as a framework for future projects. Moreover, since I was a solo dev on this project working for a friend, I wanted to keep it as proof that I had created the website and just generally to CMA in case anything went wrong.</p>
<p>I recently realized this backup had connection info for an SQL database in it. Had completely forgot about it and have only just realised. The website isn't even up anymore and the details were created by me in cPanel.</p>
<p>My question: Should I redact these? Should I delete the files? Is there any issue with me keeping these on my PC? I've never used them, never would use them, and obviously they're not of any use to anyone now. I'd like to keep the web files if possible, just so that I can keep a trail of what I've done for the website and as proof that it was me working on the website.</p>
<p>As a note: The SQL Connection details were in my name, if that makes any difference. The website went down a little after I stopped working on it, can't be sure how much longer after.</p>

<p>Summarized, GDPR is about documented permissions and processes, and balances of interests.</p>
<ul>
<li>If Alice pays Bob to develop a website, but not to operate or troubleshoot it, then Alice should never, ever give Bob access to productive customer data. It is up to Alice to change any default passwords configured by Bob, and it is up to Bob to explain how in the documentation.<br />
Alice is required to keep her (changed) credentials in a professional manner, which would probably not be done by putting them into the source code. (Technical and organizational measures.)</li>
<li>If Alice pays Bob to develop <strong>and run</strong> a website, then Bob will need credentials to access the data. It is up to Bob to keep his credentials in a professional manner, and it is up to Alice to revoke those credentials when Bob stops working for Alice. In the role of a developer, Bob should explain to Alice how to do that. (Best as part of the written operations manual for the software.)<br />
Bob should only actually use those credentials to run/support the website, not for idle curiosity. Support cases involving actual customers should be documented.</li>
<li>Of course Bob must not install any &quot;hardwired backdoors&quot; into the code. Credentials in the source code would probably be considered unprofessional security and a gross security risk, but not as a deliberate backdoor. (Backdoors tend to be more stealthy.)</li>
</ul>
