If you're a small business, you are likely to receive a very small number of such requests, if indeed you receive any at all. For most small businesses, someone would simply do a manual extract/delete of the data if it was ever requested.

Regarding backups, realistically you are not going to be required to delete from them as it's completely impractical to delete a single user's data from backup. You just need to be straight with your users - tell them that their data will be removed from your live system immediately, but that some data will remain in archive, securely encrypted, until the end of your defined retention period.

/export?userId=x (make sure to validate they are logged in)

gather data: select * from every table that has userId

pack it into understandable format: every language i have used makes json, xml, csv pretty darn easy

delete: delete from....

backups: i am surprised your hobby project takes backups. perhaps have a table with userIds that were deleted, and when you make your new backup, remove all their data?

> delete: delete from....

Ah yes, and then all of my data has holes in it that I need to deal with. "Hmm, we only have 5 orders for this, but we're missing 6". "hmmm, we charged this credit card, but there's no order for it and I'm not sure if we ever shipped anything?" "hmmm, how do I delete this tracking number from the postal systems' records?"

I thought we were talking about hobby projects here? If you are shipping things, collecting payment info, you should be taking things seriously.

Since when does selling things exclude something from being a hobby?

Etsy https://www.etsy.com/ is full of shops of people who create things as a hobby, but do try to sell things. There are many hobbyist creators who make a few things and try to sell some of them, at least to recoup costs and maybe even earn a little money. In many cases I suspect they earn about $0.001/hour. As a business, it's terrible; as a hobby, many enjoy it. I think "earning a competitive wage" is a reasonable cutoff for at least being on the road to a "real" business.

hmmm.. if we're going to draw a line between "hobby" and "profession", then that's perhaps the most obvious way to do it.

Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must.

> Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must.

Will regulators agree with what I "must" keep?

I suspect most people just ignore the backup part. Out of sight, out of mind...