Art. 5:
Personal data shall be:
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed
Recital 39:
The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum.
The GDPR is very explicit on this point. You must delete or thoroughly anonymise personal data as soon as is practically possible.