> make a write-only backup of your encryption keys every day and only keep the backups for a week (or a month, or whatever the legal requirement is). A month w

> make a write-only backup of your encryption keys every day and only keep the backups for a week (or a month, or whatever the legal requirement is). A month would be better than a week, but it still allows a situation where the wrong user account is accidentally deleted and the mistake is not noticed for a more than month. I think the best approach is for the EU regulation to give the company 90 days to delete the user's data. The company can then just have a cron job to delete older backups. Simple.