Do you have a policy for how long you retain client data after they no longer work with you? I have old files, emails, contracts, etc., for clients that I haven't spoken with in several years. I also have records from client companies that no longer exist (I work primarily B2B). Is there an ideal amount of time after which you just delete old records? If the company shuts down, do you delete everything sooner? I would keep items that can be used for my portfolio, but I don't know the value or liability in keeping anything else. I have had clients leave and then return a year or so later, so I do want to keep records for at least a year.
As regards myself, I kept all data/messages/documentation/source code (software is my business) since I have been freelancing, say 20 years ago.
Every now and then, the client may return after years, and this is useful. In some cases, an NDA was concluded with the client; but regardless, in all cases I keep that material strictly confidential.
For safety, or if you are bound to the rules of the General Data Protection Regulation, you can mention this in your general sales terms, your offers/contracts or your GDPR declaration.
Note that "the company shuts down" is usually an event that you are not informed about.