Backups and erasure have no clean answer

A backup is an immutable snapshot by design, and deleting one row from one is either impossible or defeats the purpose of having it.

what the three defensible positions are:

  1  a bounded retention window, documented — the data is
     gone within N days, and no backup is restored without
     re-applying pending erasures

  2  crypto-shredding — per-subject encryption keys, and
     deleting the key. expensive, and decided before the
     first row is written.

  3  a replay log of erasures, applied after any restore.
     the operational answer, and it must be tested.

what is not defensible: claiming the data is deleted.

The third option is the one most systems can actually implement and it is only real if the restore procedure includes it — which means the erasure log is part of the disaster recovery runbook rather than a separate concern. Testing it during a restore drill is the only way to know it works.