GDPR fines are pretty hefty. I doubt the employer would be happy with soft deletion.

Also, you don't need an auditor. In the eventuality of a hack, the db could be made open and then it would become clear you were not deleting