GDPR — how do I handle a data deletion request from a contact?

Good distinction to make — unsubscribing only stops future sends, it doesn't erase their data, which is what a GDPR Article 17 request actually requires. Use the contact's purge action (available from the contact's detail page, or via the API's purge endpoint) — this permanently removes their record and all associated event history (sends, opens, clicks, replies), not just their subscription status. This is different and more thorough than a normal delete.

Purge removes them from the live database immediately, but backups taken before the purge would still contain that record until those backup files age out per your own backup retention policy — that's true of essentially any system with backups, not specific to SubsiMail. If your backup retention is, say, 30 days, the data would be fully gone (including from backups) within that window. Worth documenting your backup retention period as part of your GDPR compliance records, since regulators generally accept a reasonable, disclosed retention window as compliant.