You don't keep the backup forever. GDPR forces you to reasonable measures for deletion. You could also keep a record of "to-delete" primary keys in event of a

You don't keep the backup forever. GDPR forces you to reasonable measures for deletion. You could also keep a record of "to-delete" primary keys in event of a restore along with your backups. All of this should have been implemented a long time ago, some European countries demanded this already. I am surprised by the lack of imagination of people if they don't want to implement something (too burdensome, technically impossible,...) who can come up with decent solutions if it fits them. A little anecdote for this: Recently I wanted to buy some insurance. The insurance company demanded wide leeway in handling personal data which by law (in Germany) has to be opt-in. I returned the paperwork, explicitly stating that I do not consent to use of the data beyond what is strictly necessary for the contract. I was told that contract can be made only with consent and that I could revoke consent later (the latter is mandated by law. What a bull-shit show. I am looking forward to GDPR coming into effect to give these businesses a middle-finger.