Under GDPR right-to-erasure you dont necessarily have to erase data from backups but must be clear about how long it will hang around. The key issue is to put

Under GDPR right-to-erasure you dont necessarily have to erase data from backups but must be clear about how long it will hang around. The key issue is to put the backup data ‘beyond use’, even if it cannot be immediately overwritten. You must ensure that you do not use the data within the backup for any other purpose, ie that the backup is simply held on your systems until it is replaced in line with an established schedule. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/#ib5 https://ico.org.uk/for-organisations/guide-to-data-protectio...