Decide criteria to remove records of non-active users

This is to decide which users to delete in the database.
This needs to take in consideration non-confirmed accounts, time since account creation , never active users, and GDPR considerations. Can we also review how any other large Moodle instances might do this? An about should be a policy decision and a process (how often we delete, who does what).
Then we can create a new Task or sub-task for the actual deletion. Assuming this would be a task shared with ICT and Community Sites?