First of all, IANAL... legal disclaimer here, yada yada.
There are a million and one variations depending on why you're collection what kind of data where, who gets to see it, who agreed to what extent of their data being collected, and so on. Retention time is only one resulting aspect of these considerations... good thing you're already bringing a legal team 😄
Assuming you're talking about personally identifiable information, the best ref documents are the relevant local privacy laws and - obviously - EU regulations.
Here's a starter document for the German legal space: http://www.gesetze-im-internet.de/bdsg_1990/ (in German, has an official English translation)
Your legal team should be familiar with this... if not, get a better legal team.
Much further beyond this blows the scope of Splunk Answers. If you need on-site help in Europe let me know.
Edit: This was all about maximum retention times, laws putting limits on how long you may store stuff. The opposite exists as well, minimum retention times where the laws require you to store stuff for at least X years. That's a whole new can of worms.
