Are you aware that setting “delete=1” is essentially what file systems do when deleting a file? What file system do you suggest companies to use when they want to comply with GDPR?
That is vague, for sure, but hopefully you have the engineering skills and domain knowledge to make a good call.
Dealing with credit card data? Think a lot about it.
Dealing with movie preferences? Deleting from the database should be adequate.
Dealing with attendants from a local conference? Delete the files when you don’t need them.
(And remember: nobody will ever show up with a fine one day. It will always start with a warning and a chance to improve before any fine is applied – unless there is serious neglect.)
A filesystem will remove the entry pointing to the data on disk, and mark that region as free and ready to be reused - and it will get overwritten.