Saleor handles few aspects of the GDPR regulation by default.
A user account can be deleted from the dashboard, by a staff user. This action takes place immediately.
From the storefront, a user can request his account deletion from within his profile settings, in such case, a confirmation email will be sent to the email address associated with the account.
Deleting a user will delete his account instance, but will leave all the data used for the checkout process untouched, for the financial record. This behavior is in accordance with the GDPR regulations.