The emphasis under the GDPR is data minimisation, both in terms of the volume of data stored on individuals and how long it's retained. To summarise the legal requirements, Article 5 (e) of the GDPR states personal data shall be kept for no longer than is necessary for the purposes for which it is being processed.