IANAL but you do not need to rewrite backups to brute force compliance. You need to inform your customers what your retention policy is though. I've seen large

IANAL but you do not need to rewrite backups to brute force compliance. You need to inform your customers what your retention policy is though. I've seen large enterprises communicating backup lifetime up to 6 months after a deletion request.