It’s not uncommon to flag data in a database as deleted but not delete the data. It’s usually done for legal or auditing purposes.

Now, if the company is still using that data, that’s a problem.