Just to add my two pennies worth, GDPR comes into effect next May and you must have the ability to comply with the 'right to be forgotten'. Essentially this means you must have granularity within your backups in order to remove specific files relating to an incident/person. This makes pretty much most tape backups redundant and non-compliant.
Also, there are not a lot of cloud providers who have this ability as well. I've provided a link below that outlines the general rules around GDPR and children's data in-particular.
https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/individuals-rights/the-right-to-erasure/