It is simple. You have to apply reasonable measures to delete the data.
That is vague, for sure, but hopefully you have the engineering skills and domain knowledge to make a good call.
Dealing with credit card data? Think a lot about it.
Dealing with movie preferences? Deleting from the database should be adequate.
Dealing with attendants from a local conference? Delete the files when you don’t need them.
(And remember: nobody will ever show up with a fine one day. It will always start with a warning and a chance to improve before any fine is applied – unless there is serious neglect.)
