It's not rocket science - encrypt with a one time symmetric key, encrypt the key with a public key, store blob and key marked as deleted. Store the corresponding private asymmetric key on a hardware token to be used when you decide you need the deleted data. That way no db hack exposes any usable data.
DB hacks aren't even close to being the only (or worst) threat. Encryption means nothing in a company or bankruptcy buyout where the purchaser may have a completely different set of ethics than yours.
That is all good and well against simple actors, but does not defend against the company being bought out and the new owner(s) deciding to decrypt and sell the entire database to some shady data broker. Or against the FBI/your local equivalent coming over for a friendly visit and confiscating both the hardware token and the database.
