That agrees exactly with what CNIL said. Obviously you have to keep an index of requested deletes for the same length of time you keep backups in order to re-delete the relevant data in the event of restoring the backups.

Article 63 of the GDPR specifically covers consistency of enforcement across the regulatory agencies.