Not to mention all the backups of said databases. Imagine sitautions where you’ve got tape backups stored in vaults or places like AWS Glacier. It’s the stuff of ops nightmares.
Imagine situations where people actually read the regulation and its commentaries.
You don't have to delete specific records from every one of your backups; in case of a deletion request, you have to be able to replay that if you restore the backup. Also, have some kind of policy in place for how exactly you're handling your backups and how long you're storing them.
