Lesson for those designing cold-storage solutions--design your system, as much as reasonable, to not support deletion operations. The reason why files get lost is usually due to software bugs, bad configurations, and operator errors. Design your system to protect against these things.
The problem with that is that under GDPR you have to support full deletion of an user's data.
You can access your customer data, using the customer-specific AES key. You can access the customer-specific AES key using your private RSA key.
When you need to delete the customer data under GDPR, you can delete the encrypted AES key for that customer from your database.