Want to hoover up all available data, well then you'd better go to great lengths keeping it safe. Find yourself holding data that you now need to do something about? Delete it, unless it's business critical.

I really don't buy into this idea that the backups thing is that hard of a problem: if you're a startup, you'd design your infrastructure from the ground up with GDPR in mind which is going to put you in front of the competition and incumbents. Is it really, really, really that hard to have something that deletes stuff from backups? How long are we planning to keep backups anyways? Surely, when a user requests their data to be deleted it can be deleted from the main production database. Then when that db is backed up it'll overwrite previous versions (this new update then replicated out to other places) and just like that you've successfully (and easily) removed all applicable user data from all current db's and backups...