Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, being their storage authorized for the following purposes:
I –
compliance with a legal or regulatory obligation by the controller;
II –
study by a research entity, ensuring, whenever possible, the anonymization of the personal data;
III –
transfer to third parties, provided that the requirements for data processing as provided in this Law are obeyed; or
IV –
exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.