Control for whom? Before gdpr the general stance in the industry was we never delete user data, just mark a field saying its deleted in the db and that's that. It's been a total shift.

And it's not just that, I've seen first hand that even internal communication about customers are treated with more care as they can legally request all their data.