Yeah it depends heavily on the size of the org and how much they are willing to spend. For a large corporation this is common in fintech and government but rar

Yeah it depends heavily on the size of the org and how much they are willing to spend. For a large corporation this is common in fintech and government but rare otherwise due to the spend. But you are right some orgs are willing to make that spend. I've seen smaller corporations set retention to a year to meet some compliance requirement. Some orgs will even buy vaulting appliances that will protect the data in multiple locations and requires multiple appointed executives to "turn the key" to override a retention policy.