That's a bad way of putting it: GDPR obviously applies, but it permits storing data that needs to be stored due to other legal obligations. If "GDPR didn't apply", it would also loose all the other protections GDPR provides, which it doesn't.