you are forgetting that this is not just a technical problem. For GDPR you need to legally prove that you have taken reasonable steps to remove and keep out of

you are forgetting that this is not just a technical problem. For GDPR you need to legally prove that you have taken reasonable steps to remove and keep out of your system, the data the user has requested. This means that you need to be able to legally prove you've got a system in place. Keeping a hash is fine technically, but its a pain in the dick to defend in court, especially as its really simple to shower a jury/judge with FUD to make it look like its not a reasonable step.