For what i know, lines are never really deleted from mdl_user (just marked as "deleted"). But logs are regularly purged from oldest information.
What i do is that each year (you could do it twice a year), i make a complete backup of my whole Moodle (database, datadirectory and moodle files), that i archive somewhere in a secure way (for long time conservation). So, i'm always able to restore a whole Moodle, as it was some year ago if i need, and having all that existed at this time.
And generally, i restore it on a special (backup) Moodle server, with cron disabled, and in maintenance mode, so that it doesn't evolve anymore, and only administrators can access it, but are able to do it quickly, if in need to verify something from last year.