[TechnicalVault]

The solution with backup tapes is obvious, you encrypt the files on the tapes with session keys and encrypt a copy of the session key with a client/project or project key stored on a separate random access medium. When the project needs to be deleted you destroy the key for that project, job done. The most difficult bit is enforcing the proper ownership and location of files so that you know which ones belong to which project. More complicated schemes can sllow files to be shared between projects but the basic principle remains the same.

[rbobby]

But what about the backups of where the encrypted session keys are kept? Wouldn't this be a "backups all the way down" situation?

[oakwhiz]

Backups of keys are a lot smaller and fit on USB flash drives and CDs. So in practice keeping encrypted backups with multiple keys is easier to deal with