[jacquesm]

Exactly, you need to make this decision on a per-data item level. Financial transactions are at a different level than other customer interactions, and whatever the local laws for retention of accounting data state is what you will have to mark very explicitly as exempt.

This can get quite complicated, moreso if a company deals with both consumers and companies as customers.