It is impossible. Flatly impossible. Because you cannot see if they’ve really deleted it or not. You can rely on a “data processing agreement” which, together with $50, will buy you a small cup of coffee at Starbucks.

I federate with you here from China. I will agree to anything you like. And I will just attach an array of 16×16TB hard drives to slurp up all the data you send me. How will you know this is happening?

You can’t. It is impossible for you to know until it’s too late and I’ve used it for whatever purpose profits me.

An individual server admin can only ensure the data’s existence or lack thereof on their own server. Anything else presumes (rather stupidly) that bad faith actors don’t exist.