I'v read Facebook has long-term backups on Blueray discs where each record has the user id plus encrypted data. Each user has their own encryption key. When a user gets deleted they throw away the encryption key. I haven't seen an off-the-shelf solution for this yet.

That said purchase information might be covered by other regulation, e.g. tax law, which would overwrite GDPR. GDPR also doesn't set a fixed data expiry, you can document that records are deleted X months later (as long as it's not infinite).