[Nextgrid]

A solution I use for this is to keep 2 sets of data, one operational for the application and one for legal/financial requirements.

When an action such as a payment is taken, or the customer provides certain info that needs to be kept for legal purposes, two records are created. The former can be deleted at will by the user, the latter is completely separate and is kept for as long as needed to comply with laws/regulations.