It is simple. You have to apply reasonable measures to delete the data. That is vague, for sure, but hopefully you have the engineering skills and domain knowl

It is simple. You have to apply reasonable measures to delete the data. That is vague, for sure, but hopefully you have the engineering skills and domain knowledge to make a good call. Dealing with credit card data? Think a lot about it. Dealing with movie preferences? Deleting from the database should be adequate. Dealing with attendants from a local conference? Delete the files when you don’t need them. (And remember: nobody will ever show up with a fine one day. It will always start with a warning and a chance to improve before any fine is applied – unless there is serious neglect.)