Comment by octavn

Actually, under the GDPR, as a general rule, you can't just keep personal data on your servers forever so GDPR might be involved but for personal data cleanup reasons/requirements.