Well, it's not that simple. Even GDPR has circumstances where "Right to be forgotten" aren't applied. Even when it does apply, it must be done without "undue de

Well, it's not that simple. Even GDPR has circumstances where "Right to be forgotten" aren't applied. Even when it does apply, it must be done without "undue delay". Which is about a month. Some of them are: - "Establishment, exercise or defence of legal claims" - "Compliance with a legal obligation, the performance of a task carried out in the public interest or in the exercise of official authority." In my B2B product, I do soft-deletes, but there is a task that cleans up deleted records older than N days at a specified interval.