GDPR only say not to collect more data than needed and then not to keep them longer than needed. If you have a legal obligation to collect specific data and to

GDPR only say not to collect more data than needed and then not to keep them longer than needed. If you have a legal obligation to collect specific data and to keep them for a specific duration the GDPR are fine with that. There are similar KYC regulations and data retention laws in Europe.