No one said backups.

Deletion of the account should be as simple as overwriting a row on a few tables. If they can handle authentication process, disable accounts based on some automated processes, deletion or the process equivalent to it is similarly possible.

Even in case of backups it can easily be done (delete decryption key for this user's row, if you planned your backups right), but even if it isn't (historical backups for example), even the regulator will agree it's fine (BT, dt).