> I don't know how GDPR handles backups and what time tables are allowed for reasonable data retrieval and expunging. Keep a log of user ids who have requested

> I don't know how GDPR handles backups and what time tables are allowed for reasonable data retrieval and expunging. Keep a log of user ids who have requested deletion and purge their data whenever doing a restore. And don't keep backups for longer than required, which I think is generally something like five to seven years barring specific legal requirements.