That's the sort of question that makes the GDPR regrettably ambiguous. It uses a lot of words like "legitimate", "undue" and "reasonable", but there could be ge

That's the sort of question that makes the GDPR regrettably ambiguous. It uses a lot of words like "legitimate", "undue" and "reasonable", but there could be genuine uncertainty about how those would apply in quite a lot of practical, everyday situations. In this situation, however, we are talking about an organisation whose entire business model is built on personal data given by literally billions of people over a period of many years, with tens of thousands of employees and tens of billions in revenues, which is operating on a scale where it is demonstrably capable of designing and building replacements to its own specifications for standard infrastructure and deploying them throughout its own data centres. I don't think it would have much credibility if it claimed it couldn't guarantee to comply sooner than three months after a request because it regularly backs up possibly the largest database in the world on magnetic tape.