Actually, you can keep order data as it has to do with VAT law but you have to keep it in line with GDPR... So it not just writing some documentation, rather making sure your data is secured with up to date and taking into account state of the art technologies etc...

Lawyers can't help you with ambiguous laws very much as it takes precedents to make sure what the words mean.