> Can you explain to me how the deletion policies work?
Disclaimer: The GDPR hasn't been the law of the land for a year, so there is little precedent.
It is fairly simple, the GDPR requires that companies that control identifying information about you (or somehow delegate this), have acceptable reasons for doing so (user consent/other law/etc). When some entity controls your information the GDPR gives you certain rights. The key point here is that the company is controlling your information not you, whereas the scrapbook is under your control. The loss of control of the information creates in my mind a moral obligation to treat it a certain way. One of the rights that the GDPR confers on the data-subject is the having data deleted, this right is not absolute and if you have any other grounds (e.g. AML regulation) for keeping the data then you don't have to delete it. Additionally, deletion doesn't have to be immediately consistent, so you won't have to go into old backups and delete the data there.
TL;DR: If someone asks you to remove something, just delete it from your SQL database, and that's it.
There are two key costs for startups implementing the GDPR:
1. Privacy by Design - Make some efforts to design the information systems in your company in a way that promotes privacy.
2. Demonstrating compliance - This tasks scales with company size, you might start out with a boilerplate privacy policy, but as you grow want to be more diligent.