If you are a billable service you don't have to worry about it that much. GDPR does not overwrite current EU or member state laws and you are compelled to keep

If you are a billable service you don't have to worry about it that much. GDPR does not overwrite current EU or member state laws and you are compelled to keep financial transactions and related information usually for at least 5-7 years. If it's a free service then just pseudoanonymize any identifiable information such as first and last name, email address, phone number, IP address etc. pretty much anything that you would use to identify the user with. A hash of these values or an HMAC would be sufficient to comply with GDPR and allow you to keep them banned. You can also check your local legislation and see if you have any laws that would support you keeping PII under the justification of protecting other individuals.