How do you deal with user requests? You need at least somehow be able to gather the data, pack it into an user underdstandable format, and delete database entries, also from your backups.
Regarding backups, realistically you are not going to be required to delete from them as it's completely impractical to delete a single user's data from backup. You just need to be straight with your users - tell them that their data will be removed from your live system immediately, but that some data will remain in archive, securely encrypted, until the end of your defined retention period.
gather data: select * from every table that has userId
pack it into understandable format: every language i have used makes json, xml, csv pretty darn easy
delete: delete from....
backups: i am surprised your hobby project takes backups. perhaps have a table with userIds that were deleted, and when you make your new backup, remove all their data?
Ah yes, and then all of my data has holes in it that I need to deal with. "Hmm, we only have 5 orders for this, but we're missing 6". "hmmm, we charged this credit card, but there's no order for it and I'm not sure if we ever shipped anything?" "hmmm, how do I delete this tracking number from the postal systems' records?"
Will regulators agree with what I "must" keep?
I found the ICO's guide[1] fairly straightforward to understand though.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
I really think some people are just completely blowing this up into something it's not, probably because the only thing they've read about it is others scaremongering.
As a business owner that cares about privacy, I was basically compliant already - all I had to do was reword my privacy policy a bit to make it more human-readable.