It also requires that user data can be hard-deleted on command. The ability to wipe data from backups needs to be kept close at hand.