The only way _you_ can think of is "invading privacy". If you delete any data that can single out people when you're ingesting it, then nothing more needs to

The only way _you_ can think of is "invading privacy". If you delete any data that can single out people when you're ingesting it, then nothing more needs to be done. So you delete any user identifying data by default, not keep it from the very start, unless you have a very strong use case. You can also have completely anonymised but still useful data. There are many statistical methods to collect useful but reasonably and provably anonymous data like differential privacy. If the businesses that give you data don't provide the option of completely deleting it then they are non-compliant as well.