Certain data loss protection regulations, such as the General Data Protection Regulation (GDPR) in Europe, require companies to store data only for as long as necessary. Unneeded and unused data can make organizations bigger targets for hackers and information thieves. Unless the organization is actively using sensitive information, it should be destroyed or deleted.