There's two pieces of this here: 1. If you're legally obligated to keep information, you should keep it. This is one of the "legal bases" of handling personal

There's two pieces of this here: 1. If you're legally obligated to keep information, you should keep it. This is one of the "legal bases" of handling personal data. Others are things like they consented to this, you have a legitimate business activity with it, they contracted you to do something with it, etc. 2. The GDPR makes a really clear distinction between personal information (email, name, religion, etc.) and everything else: you need to delete the personal information. So it's not necessary to do a cascading delete of everything the user ever created if they ask for their _personal_ information to be removed. This isn't really GDPR related, but you can see this on Reddit sometimes where comments that a user remain, but the user deleted their account.