While you probably do need to expect to delete usernames (usernames are expected to be identifying), but the user sneaking personal data into fields where it is

While you probably do need to expect to delete usernames (usernames are expected to be identifying), but the user sneaking personal data into fields where it isn't expect is probably out of scope as not part of a filing system anyway. Certainly I wouldn't expect a serious problem to punt it to "we'll deal with it manually on a 3-month turnaround if it becomes relevant" as long as you're not actively designing your systems to not be able to delete data.