> Your company/organisation should establish time limits to erase or review the data stored.

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

> In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.

Have you not gotten, over the past few years, emails from services you no longer use and probably forgot that you ever setup an account for, informing you that they will delete your account if you don't use it soon? It's because of the GDPR.