The GDPR specifically says you don't have to delete the data if you are legally required to keep it for other reasons. Most often this is financial data, but there are plenty of other examples.