Storing everything "just in case" is just hoarding with a server bill. Every byte you keep is a liability you have to defend, and attackers only need one unguarded copy. Retention policies should be treated like security controls, not afterthoughts. If you can't justify why a dataset exists, delete it before a breach does it for you.