They should be forced to hard delete the data and all its copies. Not anonymize it or soft delete it. Hard delete it as in zeroing all of it and all data derive

They should be forced to hard delete the data and all its copies. Not anonymize it or soft delete it. Hard delete it as in zeroing all of it and all data derived from it. Then report on how the data was shared and force each entity receiving the data to delete it as well.