This seems like a false dichotomy or, at best, a very vague discussion if you don't point out a specific regulation to run afoul of. Taking GDPR and its ~1995

This seems like a false dichotomy or, at best, a very vague discussion if you don't point out a specific regulation to run afoul of. Taking GDPR and its ~1995 predecessor as an example, which both required personal data to be collected only when there was a reason for it, thus when you have no more use for it, it has to be deleted. However, backups are a perfectly legit reason. It's not an excuse to keep data into eternity, but checking that all systems are good after a delete run, or having a buffer period of some defined time, is definitely reasonable and should (not a lawyer) not run afoul of the regulation. So I am not sure what exactly it is you are concerned about.