You could handle such requests by tombstoning the user ID (in addition to deleting the data). By keeping the tombstone records in separate storage (it's usually

You could handle such requests by tombstoning the user ID (in addition to deleting the data). By keeping the tombstone records in separate storage (it's usually only kB, just a list of hard-removed user IDs), you can guarantee (re-do) the erasure even after having to do a full database restore.