I've been talking to our people about data retention for both our HE and FE courses and it seems that most of the requirements for retention seem to be more metadata. It is important (for some) to keep the data for several years, but others as you say just months.
The data that is required in the main though are things like grades, feedback, dates etc - not the actual submissions. If all your data of this type is kept in Moodle then this will have more of an effect on you I am sure but I believe most of our data of this type is actually stored in our student database and other systems external from Moodle.
Personally because of this I am aiming to only keep 4 years of Moodle and they can keep the records externally to Moodle for as long as they like.
Not sure if this is helpful at all - but it may be if you keep records of these things outside of Moodle.
Tim Gildersleeve (VLE Manager - Bradford College. UK)
Makes me wonder...I predict a possible future problem due to GDPR. In the past, numerous people have been caught claiming academic degrees, that in reality, they never earned. In the future I see these same low life types blaming the GDPR right to remove data and be forgotten, as the reason no proof of their degrees can be found.