If the data is linked to an individual person, then it is personal data and the company has limited rights to hold that information in a storage and retrieval system. If it is fully anonymised it is not personal data. It is not about disclosure but about the mere possession of personal data.