Even in the light GDPR, deleting a user is just one option. GDPR mandates that data that is no longer used should be removed, and auditing might be a good reason to keep the data. Depending on the scenarios instead of deleting a record, it could be anonymized.
