Sure, Article 6, section 1c (https://gdpr-info.eu/art-6-gdpr/); https://gdpr-info.eu/art-6-gdpr/); processing is lawful if "processing is necessary for complian

Sure, Article 6, section 1c (https://gdpr-info.eu/art-6-gdpr/); https://gdpr-info.eu/art-6-gdpr/); processing is lawful if "processing is necessary for compliance with a legal obligation to which the controller is subject" I think (like the GP) you're oversimplifying though. Have you ever had to determine what is considered a "legal obligation"? It's not fun. Much to the distaste of us engineers, it turns out that most laws are not written in an unambiguous fashion; many (like HIPAA) are very vague in places, and rely on precedent or tribal knowledge about how the regulator in question tends to interpret things. So yes, if you have a clear, unambiguous requirement to keep Personal Data, then you don't need to lawyer up. If you work in an industry with complex regulations, then you're going to need lawyers and/or consultants to tell you how to resolve the conflict between GDPR and those regulations.