On: EU GDPR – Another reason for SaaS to reconsider on...

[a_imho]

You are not expected to delete data from backups

Why not? Wouldn't it be a very convenient loophole to keep user data? Yes, it sounds very complicated, but not like it was introduced overnight.

[bkanber → a_imho]

Basically GDPR says that you can keep backed-up data but you must have your backup retention age and processes defined. That is, it's ok to say "we retain backups and logs which may contain your data for 30 days".