How to Delete Customer Data From an AI Tool
Working out how to delete customer data from an AI tool starts when a customer emails and asks you to delete everything you hold about them. You run the delete in your own database, reply confirming it, and consider the matter closed.
Working out how to delete customer data from an AI tool starts when a customer emails and asks you to delete everything you hold about them. You run the delete in your own database, reply confirming it, and consider the matter closed. In an AI-assisted stack that answer is usually wrong, because their data is sitting in at least three places you did not touch.
Here is the full map, in the order you should work it.
Where to delete customer data from an AI tool: the five places
Location | How it got there | Can it be purged? |
|---|---|---|
Your own database | you stored it | yes, completely |
The vendor's conversation or request store | every prompt you sent that contained their data | usually yes, on request or via a retention setting |
The vendor's operational and abuse logs | automatic, often 30 days | sometimes, and often only after the retention window |
A vector index or embedding store | you indexed their records for retrieval | yes, but only if you kept a mapping from record to vector |
A fine-tuned model's weights | their data was in your training set | no, not selectively |
The last row is the one that surprises people, and it is the one to be honest about early rather than late.
Work the request in this order
1. Confirm the request and start a clock
Under GDPR Article 17 the right to erasure carries a one-month response window, extendable by two months for complex requests if you tell the person within the first month. Send an acknowledgement the same day with a reference number. Most complaints to regulators are triggered by silence rather than by the outcome.
2. Delete from your own systems, backups included
Primary tables, soft-deleted rows, exports sitting in object storage, and the analytics copy that someone set up two years ago. Backups are the awkward one: the accepted approach is not to restore and rewrite every snapshot, but to record the deletion so that any restore re-applies it, and to let the backup age out on its normal schedule. Document that decision, because you will be asked about it.
If your app writes an activity trail, remember it holds their data too. What that trail should and should not keep is covered in how to add an audit log to an AI-built app.
3. Purge the vendor's conversation store
Every prompt you sent that included their name, email, order history or support transcript is sitting in the vendor's records. Most business tiers expose either a delete API, a zero-retention mode, or a support path for deletion requests. Find out which one you have before you need it, not during a request. The vendor-side questions worth answering in advance are in how to tell if an AI vendor is GDPR compliant.
4. Re-index or delete the vectors
If you built retrieval over customer records, deleting the source row does not remove the embedding. The chunk text usually lives inside the vector store alongside the vector, which means the personal data is still queryable. You need a stable mapping from source record to vector ids, and if you did not build one, you are re-indexing the collection.
5. Deal with fine-tunes honestly
You cannot surgically remove one person's contribution from a set of model weights. Machine unlearning is an active research area and not a production capability. The realistic options are: retrain the model on the corrected dataset, retire the fine-tune, or accept and document the residual risk with a rationale about how little influence any single record has.
Whichever you pick, do not claim the data has been deleted from the model. It has not.
6. Tell downstream recipients
GDPR Article 19 requires you to communicate erasure to anyone you disclosed the data to, unless that proves impossible or disproportionate. For most small teams that means the handful of processors in your stack: the AI vendor, the CRM, the email tool, the analytics platform.
The reply that closes the request properly
Specific, per-system, and honest about limits. Something along these lines:
We have deleted your account and all associated records from our systems as of 21 August. We have also submitted deletion requests to the three service providers that processed your data on our behalf, listed below. One provider retains operational logs for 30 days for abuse prevention, after which they are purged automatically. Your data was not used to train any model.
That last sentence should only appear if it is true. If it is not, replace it with what you did instead and why.
What to change so the next one is easier
Turn retention down before you need to. Zero-retention or short-retention modes convert step 3 from a support ticket into nothing at all.
Keep a record-to-vector map from day one. Retrofitting it costs a full re-index.
Know your log windows. Chat and request logs age out on a schedule, and knowing the number lets you answer precisely: see how long to keep AI chat logs.
Check the training question at procurement. Whether a vendor trains on your inputs decides whether step 5 exists at all, and the method for finding out is in how to check if an AI tool trains on your data.
Plan for the vendor disappearing too. Deletion is one exit path, and the other is covered in what happens to your data when an AI company shuts down.
Frequently asked questions
Do I have to delete data from my AI vendor as well as my own database?
Yes, if the vendor processed personal data on your behalf. You are the controller and they are the processor, which makes their copy your responsibility to have deleted.
Can data be removed from a trained model?
Not selectively with current production tooling. The workable responses are retraining on a corrected dataset, retiring the model, or documenting the residual risk. Do not tell a customer it has been removed from the model when it has not.
How long do I have to respond to an erasure request?
Under GDPR, one month from receipt, extendable by two further months for complex requests provided you inform the person within the first month. Other regimes set different clocks, so check the one that applies to you.
What about backups?
The usual approach is to flag the deletion so any restore re-applies it and let the backup expire on its normal cycle, rather than restoring and rewriting every snapshot. Document the approach and the retention period.
Do I have to tell the customer which vendors held their data?
You have to be able to. Listing the processors in your deletion confirmation is the simplest way to satisfy the question before it is asked.
The broader set of data-handling risks that come with AI tools is collected in the risks of using AI.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
