The problem is, not all personal data corresponds to the intuitive notion of "private informations". For instance, I, as a U.S. citizen, would be violating the GDPR if I operated a dumb HTTP server that stores request logs indefinitely and does no other processing, such as "python3 -m http.server". (IP addresses are personal data, and U.S. authorities can make me turn over my logs; thus, I cannot store the logs for however long I want.)

Even when you have clear legal obligations to collect a bunch of private data, you still have to figure what reasonable measures to protect it are. What's a reasonable measure when you're obligated to keep seven years of financial records about your customers in a way that lets you produce ready reports for regulators? Complete with mandatory personal identifiers for tax purposes?