That might be consequence if GDPR: they need legal proof of the legitimacy of the request and of its thorough execution.

Just as you can’t really “unsee”, you can’t fully delete data once you’re exposed to it. Something documenting its previous existence will always remain