FYI changed the minimum months for report deletion from 3 to 2. I would have personally even changed to 1. As for many small sites how don't care too much about long term metrics (except for the basic metrics that can be kept), it would be an easy to work around GDPR and for best security.
Eg you set raw data deletion to like 5 days, report deletion to like 1 month except basic metrics, then you won't need to bother about exporting any data etc since you are simply not storing such info. 2 months should be all fine though as well.