So, it is in scope, since it is covered by the law, and then the law explicitly gives you permission to make an exception. But you'd better do all of the following:
- have a legally trained person review your eventual solution and your reasoning behind it
- document the exceptions, which laws and which datums it covers
- keep track of the law as it changes, especially with new bodies of law such as the GDPR you can expect updates to reflect the situation on the ground and in a way the GDPR itself is such a change.
- be prepared to review the situation/code if the law changes in the future
- be aware that 'data retention' laws are very different from one industry to another (for instance telecommunications is a totally different beast than e-commerce)