As someone impacted by the GDPR (AAA Game Studio, and all player stats / multiplayer matches getting impacted), backups are exempted: "The GDPR is open to inte

As someone impacted by the GDPR (AAA Game Studio, and all player stats / multiplayer matches getting impacted), backups are exempted: "The GDPR is open to interpretation, so we asked an EU Member State supervisory authority (CNIL in France) for clarification. CNIL confirmed that you’ll have one month to answer to a removal request, and that you don’t need to delete a backup set in order to remove an individual from it. Organizations will have to clearly explain to the data subject (using clear and plain language) that his or her personal data has been removed from production systems, but a backup copy may remain, but will expire after a certain amount of time (indicate the retention time in your communication with the data subject). Backups should only be used for restoring a technical environment, and data subject personal data should not be processed again after restore (and deleted again). While this adds some complexity, it allows organizations to have some time to re-engineer their data protection processes." https://blog.quantum.com/backup-administrators-the-1-advice-to-deal-with-gdpr-and-the-right-of-erasure/#.Wv7qy0xFwy9 https://blog.quantum.com/backup-administrators-the-1-advice-... You are absolutely correct that following the intent of the GDPR (we don't have access to the user data once they file the request) is of utmost importance. But the prior poster is correct that the data still exists. Edit: All opinions my own and not that of my employer, etc. etc.