Primarily data that can be used to identify the user and these have a pretty good definition. If you have a database with users in it, that's basically the row

Primarily data that can be used to identify the user and these have a pretty good definition. If you have a database with users in it, that's basically the row in the Users table, along with everything in the database that has a user_id, which depending on the data you're talking about, might be enough to just set the user_id to `null`, but if unsure and if possible, then cascade delete is the safe choice. Basically that's nothing that a normal RDBMS doesn't do efficiently already. If you are using a RDBMS, you should have had a sane deletion policy on your foreign keys already. It gets more complicated with NoSQL databases of course, but you knew already that by using a NoSQL that's essentially technical debt you're postponing. But having worked on many such systems in the past, it's not a tragedy and certainly not something that couldn't be solved in the last 2 years since the GDPR was adopted. Honestly, GDPR was adopted 2 years ago and people now act all surprised that it came into effect.