Under which law. Current data retention laws are you have to retain what you say you retain. So if your stated policy is 90 days but you only keep 30, you are not compliant. But if you keep 0 and state you keep 0 days you are compliant. Obviously, there are different rules for finance, govt, and medical industries.