So, honest question for you and others who have know more about this stuff: is it possible that perhaps you're erring on the side of caution a little too much?

So, honest question for you and others who have know more about this stuff: is it possible that perhaps you're erring on the side of caution a little too much? It's a lawyer's job to worry about everything that could go wrong, and assume a worst-case scenario, but surely in many cases GDPR will be about the spirit of the law rather than the letter? For example, while I personally think the backing-up-now-deleted-user-data issue is not insurmountable, assuming it's not, I cannot imagine that these 'small companies' will be fined left and right for failing to remove a user's data from every backup. And that's even assuming that there's a high likelihood that said backups will be investigated. To make an analogy: there are quite a number of regulations in effect concerning invoicing that are flagrantly violated by almost every single small-business owner that I know. Some of them have won the 'audit-lottery' and did not suffer any significant consequences, because their transgression was relatively minor (stuff like correcting an invoice and sending it without properly sending a credit-invoice first to nullify the initial invoice). Again, I'm way out of my depth here so by all means yell at me for being irresponsible about this :).