Generally, each data subject has the right to, at any point, ask for their PII data to be deleted. However, there may be legal reasons that prevent you from deleting in PII data. For example, you may have to keep records on transactions, agreements etc. In that case, it is okay to keep the PII data, but you need to inform the data subject as to why you need to keep it and for how long. During that time, you cannot use the data for marketing purposes.
When you have deleted the PII data of a data subject, you must inform the data subject that this data has been deleted.
Also, if you share PII data with other data controllers or data processors, and a data subject asks you to delete their data, it is your responsibility to ask the other data controllers/processors to delete that data too.
Last updated: Jun 19, 2018