This is the guidance we have been given as well. It'll depend on the kind of data you're talking about. If you are obligated to keep that data for legal purpo

This is the guidance we have been given as well. It'll depend on the kind of data you're talking about. If you are obligated to keep that data for legal purposes then there's no working around that. But then make an effort to only keep exactly the data you need. However in the context you're asking - absolutely do delete where possible. If not possible then pseudo-anonymization is a way of dealing with this.