Nobody knows. Lawyers seem to split 50/50 on the issue, like everything else GDPR related. I think even asking questions like this is missing the point by now.

Nobody knows. Lawyers seem to split 50/50 on the issue, like everything else GDPR related. I think even asking questions like this is missing the point by now. See the discussion above. The GDPR doesn't say if backups are OK or for how long. They might be or might not be depending on whether a random EU official believes your justification is "legitimate". In other words, stay in the Commission's good books and you'll be fine. Take a position the Commission doesn't like and suddenly your backups might not be so legitimate after all.