You are allowed to keep some data for cases like financial stuff etc, not sure on specifics as there are quite a few national privacy laws these days (California's one, GDPR, UK's GDPR, South Africa's POPIA).
The approach to zero out data and anonymise as much as possible is sound - I've done it before for dayjob stuff. It's useful because metrics don't get skewed by data going missing.
You are allowed to keep some data for cases like financial stuff etc, not sure on specifics as there are quite a few national privacy laws these days (California's one, GDPR, UK's GDPR, South Africa's POPIA).
The approach to zero out data and anonymise as much as possible is sound - I've done it before for dayjob stuff. It's useful because metrics don't get skewed by data going missing.