This is why regulations specify that data must be destroyed within a time period, typically 90 days. It gives enough time for backups to rotate out.

If this weren’t a concern, regulations would demand immediate deletion of data.