Your backup retention policy should comply with GDPR, and you should be prepared to justify extended retention periods.