[dijit]

The way I'm handling it (probably non-compliant) is to store a list of the internal keys we use for people in a list as GDPR requests come in.

If I restore a backup it will go via this list and ensure that content in my backups which are keyed to deleted accounts are never restored.

In theory we have the data, but it's never reachable by internal systems. -- Anything else is essentially compromising the integrity of a backup.