My assumption is that this is not _really_ a technical question and is instead more of an accounting question. My assumption is that you'd have to come up with

My assumption is that this is not _really_ a technical question and is instead more of an accounting question. My assumption is that you'd have to come up with documentation showing everywhere their data goes within your system then you basically "super promise" (usually in the form of a legal contract) that you do delete it in all those places, and you _also_ create a record of those deletion mechanisms (e.g. recording the DELETE HTTP request you make to the S3 rest API). That basic approach (promise in contract then record your efforts to comply) is the approach I've seen taken for e.g. CCPA-style compliance mechanisms. Note though that what I've described isn't necessarily exactly a fit for your problem domain; nor is my description complete (e.g. if you only do what I just listed, you may have a very angry client). Just thinking out loud here.