Ensure data is physically deleted from a data file
Where I work, we had this exact issue. I wrote code that read metadata tables and redacted information for people or companies on request. I also logged the id value for every person that we redact. Hence if we do bring back an old database we have the option of taking that metadata and redacting it in any backup that we restore. It would not be practical to bring back every backup, restore, redact people who want to be redacted, do a new backup and send the backup back offsite. We can think about the retention that were need for offsite backups. Ideally in the future we will separate the PII of people from the financial data that we need to keep longer. thus it would be easier to redact some data, but keep the data that we really need. You need more than a single answer. You need to build a framework on how to redact data and still know which data was redacted in case it needs to be redacted again.