A technical reading of GDPR leads one to think that data in a backup should also be deleted. But in practice most orgs are treating Article 7, The Right to Erasure, as meaning "make no longer publicly available."

That still leaves the issue of ensuring processes are in place to make sure the "deleted" data is not restored from backups.