A data controller shall erase personal data without undue delay, where —

(a) the personal data is no longer necessary, in relation to the purposes for which it was collected or processed, or

(b) the data controller has no other lawful basis to retain the personal data.