In reply to Peter.

The entry has to exist to process the data, send it to 3rd party integrations, interact with payment processors such as PayPal, etc.

For example with PayPal Standard the user leaves the form to go to PayPals site to complete the payment. They then return to the form via redirect by PayPal and then PayPal’s IPN communicates back that the payment was made. The entry has to exist for this to occur. Email notifications would then be sent at this point. When all processing that is necessary has been completed. THEN the entry can be deleted if it is necessary to do so.

Deleting the entry after the fact is only necessary in situations where you simply want to email the information and not store the entry beyond the processing OR you simply want to process the form through integrations (MailChimp, a CRM, etc.) and discard the entry in the database afterwards. But the entry needs to exist for the processing to occur because some of the processing occurs asynchronously.

And let’s be clear... it is not necessary to do this simply because of the GDPR. That is only one way to handle GDPR compliance and it is a bit of a sledge hammer when simply a knock may all you actually need. It depends entirely on the use case in question.