Yes, but banks tend to have websites with accounts and those accounts need to be deactivated when a customer should no longer have access (or, even more finicky, specific accounts for a client need to be deactivated or activated as they change their usage).

All this essentially forces the use of some sort of soft deletion. (Activation flags are sort of just a more complicated form of soft deletion).

not every thing is a transaction though, say a deleted piece of ref data that still has FKs to other stuff etc

Is the same true in mass surveillance?