Hacker News Reader

Backups to restore services are okay since their purposes is to restore services.

Archives should be pruned.

* Take Backup 1 which contains users A,B and C.

* User A requests to be deleted and is from prod.

* Deploy bad code between backup 1 and 2 - oh noes prod is corrupted!

* Restore backup 1, which restores user A

So - how doesn't this work for GDPR?

Your procedure should include what to do with the deleted users when you backup. You'd have to keep logs of it anyway. Trivial problem to solve.