[aenario]

First of all, it's not "don't do marketing", it's don't do "user-tracking-and-profiling based advertising". Marketing is so much more, like actual market research to provide a service users actually want.

You have to handle a "right to be forgotten" query within a month, surely this is enough time for one sysop to run a prepared query. If your database is so byzantine that you cant find all reference to a given customer, you are either google or in need of a new architect.

Backups do not need to be deleted immediately, they should however expires and be destroyed in accordance to your data retention policy (Say what you do, do as you say).