> Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must.

Will regulators agree with what I "must" keep?