So here is an idea about deleting accounts. Usually people may want to undo it sometime but if it's deleted it is deleted.
One of the things required by the GDPR is a way to export your data and even import it (article 20, right to portability). So you should implement a way to do that.
Then when users ask to delete their account, create an export, encrypt it with a one-time use key which you mail to the user, store this encrypted dump and remove the rest of the data. Now if the deletion was an error the user can get their key in their email and get their account reinstated. And no one in your company can access the data in the meantime.
One of the things required by the GDPR is a way to export your data and even import it (article 20, right to portability). So you should implement a way to do that.
Then when users ask to delete their account, create an export, encrypt it with a one-time use key which you mail to the user, store this encrypted dump and remove the rest of the data. Now if the deletion was an error the user can get their key in their email and get their account reinstated. And no one in your company can access the data in the meantime.