Obviously, most people might not but some will. In some countries and sectors it's a legal or contractual requirement that you keep audit trails for x years. I

Obviously, most people might not but some will. In some countries and sectors it's a legal or contractual requirement that you keep audit trails for x years. I've worked on accounting systems where the insurers and banks have both had separare requirements here. Not that this is relevant here. My point was that if people demand retroactive notice of a breach —and you're not otherwise required to notify them— even if you have that data, you can tell them to bugger off.