A backup is often the last resort when it comes to loss of data or encryption by an extortion trojan. In order to make the backup GDPR-compliant, the handling of deletion requests should be included in the backup and restore concept in accordance with Art. 17 GDPR.