I believe (not a lawyer, etc.) that you don't have to delete from existing backups as long as you have a process to immediately wipe the customer details again if that backup is restored (and before any other processing can happen.)
[edit to clarify that you wipe the customer details]
[edit to clarify that you wipe the customer details]