According to the Data Protection Act 1998 they do. The exceptions are data used for national security, the detection of crime, and taxation purposes.
The referenced Principle 6 actually doesn't cover the removal of data on the subject's request. However, this contingency is addressed in the Conditions for Processing, as in:
Consent must also be appropriate to the age and capacity of the
individual and to the particular circumstances of the case. For
example, if your organisation intends to continue to hold or use
personal data after the relationship with the individual ends, then
the consent should cover this. Even when consent has been given, it
will not necessarily last forever. Although in most cases consent will
last for as long as the processing to which it relates continues, you
should recognise that the individual may be able to withdraw consent,
depending on the nature of the consent given and the circumstances in
which you are collecting or using the information. Withdrawing consent
does not affect the validity of anything already done on the
understanding that consent had been given.
Now, if you can prove that the continued retention of the PII is needed for some other reasonable purpose, you might still be able to retain the PII. But for most forms of reporting, there's really no need for PII to be kept. It becomes more of a liability than an asset. You can generally anonymize the data and still be able to do aggregate analysis. E.g. there's no need for personally identifiable info to be retained to determine what percentage of orders of what type are coming from which provinces/cities or track purchasing trends, etc.
And if you're retaining the PII as leads for follow-up sales, it's unlikely they'll be useful if they're mad at you for not removing their PII from your databases as they requested.