Data kept 'just in case' becomes evidence against you in a breach and liability in litigation. A retention schedule that's actually enforced is a privacy control, a security control, and a legal control in one.
“The safest data is the data you deleted last year.”