Most tech companies make use of short retention policies for this exact purpose. 18 months to 2 years by default, otherwise anything longer goes through an exception approval process.