There's two aspects to this 1) Holding backups for too long that eventually contain user data you no longer need and 2) backing up user data that you no longer

There's two aspects to this 1) Holding backups for too long that eventually contain user data you no longer need and 2) backing up user data that you no longer needed in the first place. Working in security I have been advising clients to make sure that they consider their obligations for retention periods. Not just so that you release user information you no longer need at the point you no longer need it, but also to reduce litigation if there were to be a data breach.