Real question, how do you audit that data got deleted with certainty, and not just locked away out of reach for the time being? To me this seems like a fact hard to prove.

How can you audit that all copies of data are deleted? there is simply no way.

You can make infinite copies of data and do contortions around the definition of deletion, like "soft deletion", "anonymization", etc.