the law will ultimately be the deciding factor however adding in some relevant T&Cs would be a good first step. Ultimately in most countries you will be requir

the law will ultimately be the deciding factor however adding in some relevant T&Cs would be a good first step. Ultimately in most countries you will be required to delete personally identifying information upon request, I would expect this to include name, address, dob etc. It would not include meta data which is not really identifiable if the previously mentioned data has been deleted. Messages in a forum is perhaps something you need to consider but I would push this onto the user, i.e allow them to edit/delete old posts.