Retention means they still holding data. Even if they only hold data for 30 days, that's still data that can be leaked or stolen.