The General Data Protection Regulation (GDPR) gives individuals the right to ask for their data to be deleted and organisations do have an obligation to do so, except in the following cases:
the personal data your company/organisation holds is needed to exercise the right of freedom of expression;
there is a legal obligation to keep that data;
for reasons of public interest (for example public health, scientific, statistical or historical research purposes).