The question "how long should I keep data from my research" is basically a synonym for "how long should my research be relevant for?" Once your work can no longer be reproduced, its value and ability to be a part of the discussion on its topic is seriously limited.
This doesn't mean that you necessarily need to stash your datasets forever, but I do wonder why anyone would ever choose to enforce the obsolescence of their own research. There are many excellent solutions online that make maintaining it costless and virtually effortless*. Something as simple as putting your code on GitHub and your data on Google Drive, making both public and providing a link to them on your website will take care of the issue for the foreseeable future. Of course if Microsoft or Google ever decide to terminate these (extremely popular) platforms, you would have to make new arrangements, but at least it would all be collated in one place and ready to go elsewhere.
As for the GDPR, it's my understanding that only applies to personal data. In fact if you pull up the Wikipedia entry for it, the "Exceptions" section clearly lists scientific research.
The only other exception I can think of is the case of private or personally-identifiable data, such as health surveys. In this case control of the data was probably (hopefully?) spelled out in the initial proposals, and/or taken before an IRB.
*I am assuming here that your data isn't "big" data. If your work relies on half a terabyte of data, everything changes. But if you work in the field of "big data" you likely have more knowledge of how to work with it already.