Or have a documented retention policy for backups and a procedure to redelete data when those backups are restored.