Deleting versus anonymising, and the accounting rows

A deletion request does not override a legal obligation to keep invoices, so the answer is per table rather than global.

-- deleted
DELETE FROM sessions WHERE user_id = ?;
DELETE FROM saved_searches WHERE user_id = ?;

-- anonymised, because the row must survive
UPDATE customers SET
  name = 'Deleted customer', email = CONCAT('deleted-', id, '@invalid'),
  phone = NULL, address_line_1 = NULL
WHERE id = ?;

-- and the foreign key that must not cascade:
-- orders.customer_id stays pointing at the anonymised row

The anonymised row keeping its identifier is what preserves referential integrity and the reporting that depends on it — an order with a null customer breaks every aggregate. Choosing an email that is syntactically valid and undeliverable matters too, because a null in a NOT NULL column and a real address are both wrong.