As far as I know the data must be properly deleted not just marked as deleted. Essentially you can zero out all fields which include personal information. Keeping the data as soft deleted you still risk it in case of a leak due to a hack.