> Most institutions (especially financial) have strict document retention policies to protect themselves from situations like this. It's not shady – just a way of limiting liability.

Yup. With every data breach, HN is full of (correct, imo) comments about how tech companies should treat private data as a liability and prune it aggressively.

You go look at mature businesses and you'll find that they do exactly this.

And less mature businesses that are in highly regulated industries, since they know nobody will fund them if they can’t prove they aren’t a legal timebomb. I’ve worked across clients in edtech, fintech, healthtech, aerospace, and in all of them making sure they didn’t die by regulation was present from early on. (Granted, places that don’t care about things like that don’t work with people like me.)

Edtech in particular tends to be pretty conscious of just never having the data in the first place. PII for minors is radioactive.