I am part of the team on a popular website that provides users with overviews of their statistics for a particular game.
Our data is gathered from a publicly available API and in order to provide our users with features like graphs of their performance over time we store a records of their statistics each time they are searched.
In order to uniquely identify each account the game developer gives each user a unique ID (appears to be UUID v4) and this unique ID is stored in our database alongside the statistical data. Other than this unique ID, and the players current in-game username (which can be changed by users every 30 days), no other personally identifiable information is provided in the public API.
The Terms of Service of the game developer explicitly state that by registering to their service - which you need to do before you can play this game - the user is agreeing that the owner of all content (including usernames etc) belongs to the game developer.
We do allow users to register to our website using their email address - we are already taking measures to allow users the "right to be forgotten" and to remove this email address from our records by deleting their account. Aside from our GDPR responsibilities for this, do we need to worry about any other GDPR implications?