[steve_gh]

Well that's just a crock. You simply have to have a policy that says how long you retain backups for, and what you would do if you needed to delete PI if required to do so under GDPR.

It's not rocket science!