As Nadish mentions, the most in-depth/complex solution is to not only export and store the original file on disk but reimport into one or more databases.
Perhaps data is published in an online transactional db for a certain period, after which it's moved to a data warehouse (if long term reporting is strictly required) or archived again to nearline storage (if, as is usually the case with marketing data, original raw data will never be useful after a certain point) so it can be permanently purged after awhile.
Or maybe the data is left in its original CSV files, if it'll only be used on demand for forensic purposes. That's much easier if it's all you need!
But the wildcard is the legal angle, which we can't help you with. If you're required by law to keep records for N years, possibly in a non-alterable (WORM) type of format for non-repudiation, your tech needs will be different.
.png)