Sure, but only if you you then never process that data for reasons not covered by your legal basis and privacy policy. It's not only the collection of data that

Sure, but only if you you then never process that data for reasons not covered by your legal basis and privacy policy. It's not only the collection of data that is covered by the GDPR - it's any processing as well. Easiest way to do this is probably to duplicate data into another table for tax audit purposes, that your "normal" applications have no permission to read. Then you can delete everything your application can access and still keep legal records.