GDPR and backup: What have we learned in one year?