A technician at a company that sells products online receives a written request from a customer in Germany asking that all of their personal data be permanently deleted from the company's systems. The company processes orders and stores customer records in a database. Which regulation most directly governs how the company must respond to this request?