The GDPR also requires personal information be removed from backups, or at least after a backup is restored (eg: restoring from backup does not negate the origi

The GDPR also requires personal information be removed from backups, or at least after a backup is restored (eg: restoring from backup does not negate the original Right To Be Forgotten request). So while you can remove some of that info yourself, I don't think that can be seen as fulfilling GDPR requirements. Disclaimer: I am neither a lawyer nor GDPR expert.