I don't think the GDPR imposes a requirement to actively filter backups.