IANAL, but IMHO a soft 'deleted_at' timestamp along with a daily cron job that hard deletes everything with a deleted_at older than 24 hours would fall within the spirit of the law.
I agree that just having a deleted_at timestamp and old entries are never pruned would not be a good faith interpretation of the law.
From what I have seen, there is no requirement for instant deletes. Even emailing a support address and having them manually delete the data is acceptable. Most places using deleted_at never clean up the data from what I have seen though.
I agree that just having a deleted_at timestamp and old entries are never pruned would not be a good faith interpretation of the law.