The main problem really boils down to:
There is a lot domain data inside a tenants database that does not belong to the user and there is data that belongs to the user. The tenants want to restrict access to the former on membership cancellation, I need to grant access to the latter.

Maybe I could do that all the time from now on. Insert all user domain specific records also into a separate database that only belongs to that user. However, that would lead to many many databases and its not possible for the past.

And I think that it wouldn't be the most elegant solution...

So I thought about copying all relevant records into a separate database that only belongs to that user. But if that happens for more than one tenant, I have to fiddle with all primary keys (or switch to UUIDs completely) to not have colliding keys.

Users are global in my case, n:m to tenants.

I can switch tenants indefinitely for the users, but their domain data stays in the different tenant databases. And the old tenants do NOT want them to login any longer or at least restrict them to data prior to the membership cancellation.

Some solutions that come to mind:
- export the data to another database (with all the primary key hassle)
- limit access to records prior to a specific exit date (however that would the implemented)
- completely different solution I am not thinking of

On a side note: have you ever thought about what to do when a user of one tenant is no longer part of that tenant but needs to access data inside the tenant scope (e.g. accounting data) and is still a customer but in another tenants scope?