And even (1) isn't always needed. There are several justifications for processing personal data, and permission is only one of them. (Although for compliance it is the easiest)
https://gdpr-info.eu/art-6-gdpr/
And (5) has a bunch of caveats. You don't always need to delete data.
Right to Erasure: https://gdpr-info.eu/art-17-gdpr/