Definitely legal. In Teams our messages are only retained for 90 days. You have to create a team for messages to be stored permanently. Similar for surveillance footage. Fortune 50
If you are only required to keep data for one year and you keep it for 2 years, you can still be subpoenaed for that 2 year old data if you keep it. Thus, keeping data for longer than you are required is an increased business risk.