Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, being their storage authorized for the following purposes:
I –compliance with a legal or regulatory obligation by the controller;
II –study by a research entity, ensuring, whenever possible, the anonymization of the personal data;
III –transfer to third parties, provided that the requirements for data processing as provided in this Law are obeyed; or
IV –exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.