PII should be destroyed or deleted when it is no longer needed. This helps protect the data from being accessed by unauthorized individuals.