What is a well-defined concept for GDPR compliance?

Records that are relevant to an existing contract agreement can be retained as long as the contract is in effect.

Data controllers must confirm to data subjects as to whether where, and why personal data is being processed.

Personal data that was collected before the compliance standards were set do not need to be protected.

Compliance standards apply to organizations that have a physical presence in Europe.