[hobofromabroad]

That's because there are other legal reasons to keep that kind of data.

But that isn't a reason to keep all kinds of data related to a user account.

Monetary transactions, claim data for insurances, but not support requests for instance.

[ComradePhil]

Support requests can be kept as long as you anonymize them. This is true for everything else. Look up "GDPR anonymyzation".

[eivarv]

Yes, if you mean true anonymization – i.e. not pseudonymization (e.g. replacing names with a pseudonym) or in any other way retaining personal data (internal identifiers, usage patterns or attributes that combined result in a unique enough fingerprint to identify a specific person, etc.)