Article 17 of the GDPR ("Right to erasure (‘right to be forgotten’)") says:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
...
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
Paragraph 3 (d) of article 17 says further that the right to erasure does not apply when:
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing;
Recital 65 of the GDPR says:
A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.
The mention in Paragraph 2 of article 17 that the Controller "... taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, ..." while directed to informing other controllers of an erasure request, seems to indicate, along with the exception for archiving in art 17 par 3(d) that as long as measures are taken to prevent access to the data for which erasure has been requested, that such data is not fully erased is not a violation. But I cannot call that conclusion authoritative.
The ICO says:
If a valid erasure request is received and no exemption applies then you will have to take steps to ensure erasure from backup systems as well as live systems. Those steps will depend on your particular circumstances, your retention schedule (particularly in the context of its backups), and the technical mechanisms that are available to you.
You must be absolutely clear with individuals as to what will happen to their data when their erasure request is fulfilled, including in respect of backup systems.
It may be that the erasure request can be instantly fulfilled in respect of live systems, but that the data will remain within the backup environment for a certain period of time until it is overwritten.
The key issue is to put the backup data ‘beyond use’, even if it cannot be immediately overwritten. You must ensure that you do not use the data within the backup for any other purpose, ie that the backup is simply held on your systems until it is replaced in line with an established schedule. Provided this is the case it may be unlikely that the retention of personal data within the backup would pose a significant risk, although this will be context specific. For more information on what we mean by ‘putting data beyond use’ see our old guidance under the 1998 Act on deleting personal data
In the page "We All Know About GDPR’s Right to Erasure, Does This Mean You Have to Delete Data From Backups As Well?
" from teh law firm of Hall, Booth, Smith the authors say:
Unfortunately, the GDPR does not address personal data in backups with regard to the right to erasure. There is not an exception or a “safe harbor” that allows an organization to maintain a backup when they have received a valid request to erase. This can be disconcerting in view of the difficulty in deleting backup data. It is not easy nor practical to remove a single record from the backups. Many backups cannot be searched for a single record, without restoring the entire backup. An organization must also be careful not to affect the personal data of other data subjects in an attempt to delete the personal data of the data subject who has made the request.
Fortunately, several European supervisory authorities have issued guidance on how to handle backups when receiving a request to erase. The Danish supervisory authority has issued guidance stating that personal data must be deleted from backups where technically possible. However, there are cases when erasure from a backup might be technically possible, but is extremely cumbersome and expensive. It is not clear whether technically possible means at any cost, or only when reasonably technically possible. If the organization does not delete the personal data from the backup because it is not technically possible, the organization must ensure that the personal data is deleted if the backup is restored to a production system or a production data base.
The UK’s supervisory authority, the ICO, released guidance stating it is necessary to take steps to ensure erasure from backup systems. Such steps may depend on the organization’s particular circumstances, its retention schedule and the technical mechanisms that are available to delete personal data from backups. The UK recognizes that data may remain on backups for a certain period of time until the backup is overwritten. The UK has indicated that they will be satisfied if backup data are put “beyond use” even if it cannot be immediately overwritten.
...
The import of the guidance from the various supervisory authorities is that if an organization does not delete personal data from backups when there is a request for erasure, the organization needs to document why it is technically not possible for feasible to delete the data from backups, inform the data subject that personal data will exist in a backup, and when the backup will be deleted
See also GDPR - Right to erasure - Conflicting laws
