Ask HN: How are you implementing GDPR-compliant soft deletes?

The idea: Customer requests account or item deletion, you set it to "deleted" in DB without actually deleting it and it helps for documentation purpose should the dispute arise over some issue in future.