The GDPR applies to data pertaining to an identifiable person. Anonymised data is more or less equivalent to deleted data as far as the regulation is concerned. Source: I was a DPO for 5 years.

The org i used to work for had to develop a special process to delete user data upon request, it was not an easy process in dynamics365

if you want something deleted you best destroy the hard disk yourself lol

The requirement exists unless the company is under legal obligation to retain something. I had one case where I requested a GDPR data dump followed by a full deletion, and apparently whoever executed the request deleted first and then processed the dump, so I was able to see that what they did was change my email address from username@mail.tld to username#mail.tld@company.tld - meaning that login attempts, password resets etc. would clearly fail, and a further attempt to request my data revolving around my email address would be unsuccessful, but ultimately all my data was still accessible somewhere. Whether they'd then proceed to delete it after the retention period, who knows. I intended to follow up but forgot...

There's no independent audit for GDPR compliance so the only way to know would be if someone whistleblows. There are also so many loopholes that allows to keep the data like "to prevent further abuse" or "some legal reason".

So if reddit bans your account they can keep all data and you can't do anything about it even with GDPR.

Not quite, deletion from a hard drive also unflags the space the data was located at as being in use, so it will be overwritten eventually so long as the drive continues to have things written to it. Simply flagging something as being archived means that information will remain on the server indefinitely, the exact opposite of what is intended by a delete button.

I guess I’m naive and believe people would be honest.

drill bit*