Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, but their storage is authorized for the following purposes:
I – compliance with a legal or regulatory obligation by the controller;
II – study by a research entity, ensuring, whenever possible, the anonymization of the personal data;
III – transfer to third parties, provided that the requirements for data processing as provided in this Law are obeyed; or
IV – exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.