Forgive me, but I'm not sure why this is even a question. Compliance comes first, because if you don't comply with legislation you most likely won't be in busi

Forgive me, but I'm not sure why this is even a question. Compliance comes first, because if you don't comply with legislation you most likely won't be in business for long. So you then build on from that by designing your system to take compliance aspects into account. If you do that, then the backup question no longer occurs, because your system design has taken into account the fact that (for example) GDPR "Right to be forgotten" exists, and so you will have ensured you have a mechanism in place to ensure the "forgotten" PII does not make its way into your backups.