You can do both. Soft delete immediately when requested. Hard delete (if still soft deleted) when GDPR requires it. Besides it's not like all data is the sam

You can do both. Soft delete immediately when requested. Hard delete (if still soft deleted) when GDPR requires it. Besides it's not like all data is the same. Use what's appropriate when it's appropriate. Nobody's saying "you must always soft delete, and then immediately tweet the audit trail, print that tweet, put that printout onto a rocket, and launch it to the moon for later retrieval. with a blockchain for extra GDPR hate".