Comment by aforwardslash

That is well covered within GDPR scope. Retaining data to fulfill legal obligations is allowed. One common related example is invoice data.