The right to be forgotten lets a user request deletion of their data. You have 30 days to respond.
Right to be forgotten (GDPR) — ComplySOS