AI Privacy: AI Data Privacy, GDPR and AI, and Data Subject Requests Across Your AI Systems
Shipping an AI feature does not create a new privacy law. It creates new places for personal data to sit. Prompt logs, retrieval indexes, fine-tuning exports and agent memory are copies of customer records, and a request that lands next month has to reach all of them.
found
scanned
Assembling the cover letter from the template...
Helps you comply, not legal advice
In short
AI privacy is the set of data protection obligations that attach to personal data once it moves through AI systems: what you may collect it for, how long you keep it, who you disclose it to, and what you owe the person when they ask. The obligations themselves are not new. The GDPR and the US state privacy laws apply to a vector store and a prompt log exactly as they apply to a CRM. What is new is where the data ends up, and that almost nothing in a typical AI stack is in the system inventory a privacy team works from.
When someone sends an access or deletion request, the legal scope is every system holding their personal data. In an AI stack that reaches prompt and completion logs, retrieval indexes and vector stores, fine-tuning and evaluation datasets, feature stores, and the memory an agent accumulates about a named user. Every one of those is a copy, most were created by engineering rather than requested by the business, and deleting the source record in the production database does not touch any of them.
The model itself is the question everyone asks about, and the answer is more careful than either extreme. In Opinion 28/2024, adopted 17 December 2024, the European Data Protection Board held that an AI model trained on personal data is not automatically anonymous. Anonymity has to be assessed case by case, and the bar is high: the probability of extracting personal data from the model, directly or by querying it, must be insignificant for every data subject whose data was used, judged against all the means reasonably likely to be used. So you cannot declare the model out of scope by default. You also cannot practically remove one person from trained weights. What works in practice is to delete the source records and every retrievable copy, stop future use, and document the assessment you made about the model, because that assessment is the thing a regulator will ask to see.
California added a genuinely new request type. The CPPA regulations took effect on January 1, 2026, and businesses using automated decisionmaking technology for significant decisions must comply from January 1, 2027. ADMT is defined as technology that processes personal information and uses computation to replace or substantially replace human decisionmaking, and a significant decision is one resulting in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Targeted advertising appeared in earlier drafts and is not in the final rule. Consumers get a pre-use notice, a right to opt out subject to exceptions, and a right to access the ADMT: which inputs were used, why those inputs, and how the output was used in the decision about them. That is a subject access request in everything but name, and it lands on the privacy team rather than on the data science team.
Obtainer covers the operational half. It intakes the request, verifies the requester, searches your connected systems for the person, reports the source system behind every record it surfaces, compiles one reviewable manifest, tracks the GDPR one-month and CCPA 45-day clocks, and keeps a timestamped record of what was searched and when. Nothing is disclosed or deleted automatically. A human reviews, redacts and approves before anything leaves. Obtainer helps you comply. It is not legal advice, so the scope call on model weights, the ADMT exceptions and any decision to refuse stay with your team. Self-serve from a planned $49/mo.
Last updated August 2026
Why it fits
Privacy, legal and engineering teams at US companies that have shipped AI features on top of customer data.
An AI stack is a copy machine, and copies are what get missed
A retrieval index holds chunks of the documents it was built from. A fine-tuning export is a snapshot of production records frozen at the moment somebody ran the query. An evaluation set is the same thing with a nicer name. None of these are in the diagram the privacy team was shown, and none of them update when a row is deleted in the operational database. This is the ordinary shape of an incomplete response: the deletion ran correctly in every system anyone remembered, and the person is still sitting in a vector store keyed to a document nobody re-synced. Finding the copies is a discovery problem, which is the problem Obtainer is built for.
You cannot un-train a model, and that does not end the question
The EDPB set a high bar for calling a trained model anonymous and required the assessment to be made rather than assumed. That leaves most teams in the same practical place: delete the source data and every retrievable copy, stop using the person's data for future training, and write down the reasoning for the weights themselves. No regulator has made retraining the routine remedy for a single erasure request, and treating it as one would be an odd read of proportionality. What gets organizations in trouble is not the weights. It is having no record that anyone ever thought about them.
California turned an automated decision into an access right
From January 1, 2027 a Californian who was screened, scored or ranked by software for a job, a loan, housing, a school place or healthcare can ask what inputs went into it, why those inputs, and how the output was used. Answering that means producing the person's record from the system that made the call, which is the same discovery and manifest work as any other access request, run against a system the privacy team usually does not own. The opt-out has exceptions, including where you offer a human appeal to a reviewer with the authority to change the decision, but the access right does not go away because you offered an appeal.
Reference
Where a data subject request lands inside an AI stack
Each row is a real place personal data accumulates once a company ships an AI feature. The right-hand column is what the request actually requires, which is usually not what the architecture diagram suggests.
| AI system | What it holds about a person | What a request requires |
|---|---|---|
| Prompt and completion logs | Whatever the user typed, which in practice includes names, account numbers, addresses and health details, plus the model reply | In scope like any application log. Retrievable and deletable, so access and deletion both apply on the normal clock |
| Retrieval indexes and vector stores | Chunks of source documents and their embeddings, keyed back to the record they came from | A second copy of the source data. Deleting the source row does not remove the chunk unless the index is re-synced or the chunk is deleted directly |
| Fine-tuning and evaluation datasets | Snapshots of production records frozen at the moment of export, often in object storage | Static copies living outside the operational database. Usually the least catalogued and the easiest to miss entirely |
| Agent memory and transcripts | Accumulated facts and summaries about a named user, written by the system rather than supplied by the person | Personal data the person never handed you directly, and inferences of the kind the CCPA names at Civil Code 1798.140(v)(1)(K) |
| Model weights | No retrievable record in the ordinary sense, but not anonymous by default either | Assess under EDPB Opinion 28/2024 and document the conclusion. Retraining is not the standard remedy for one erasure request |
| Model vendor and subprocessor logs | Whatever your provider retains under its own terms, for as long as its retention window says | Reachable only through the vendor. Check the retention period in the data processing agreement before you promise the requester a deletion date |
More use cases
Related features
Questions
Common questions about this
What is AI privacy?
AI privacy is the practice of meeting existing data protection obligations for personal data that flows through AI systems. It covers what you may use the data for, how long you keep it, who processes it on your behalf, and what you owe a person who asks for access, correction or deletion. No separate AI privacy law creates these duties in the United States. The GDPR and the state privacy statutes already do, and they apply to a prompt log the same way they apply to a database table.
How does AI affect privacy?
Mostly by multiplying copies. A single customer record that used to live in one production database now also appears in a retrieval index, a prompt log, a fine-tuning export and an agent memory store, each created for a good engineering reason and none of them on the privacy team's system list. Scoping that search to what a team calls PII is where the under-collection usually starts. Volume changes too, because AI features log far more input text than a form ever did. The obligations did not change. The surface area they apply to did.
Can you delete personal data from an AI model?
Not from the trained weights in any reliable, verifiable way, which is why nobody treats retraining as the routine answer to an erasure request. What you can and should delete is everything retrievable: the source records, the prompt and completion logs, the retrieval index entries, the fine-tuning snapshots and the agent memory. Then stop using that person's data for future training and document the assessment you made about the model itself, because the assessment is what a regulator will ask for.
Does the GDPR apply to AI?
Yes, wherever an AI system processes personal data, and that includes training. The EDPB confirmed in Opinion 28/2024 that legitimate interest can be a lawful basis for developing and deploying an AI model, subject to the usual three-step test of identifying the interest, showing the processing is necessary for it, and balancing it against the rights of the people whose data is used. The opinion also declined to treat trained models as anonymous by default, which keeps them inside the analysis rather than outside it.
What are privacy considerations when using AI?
Four that matter operationally. Where the data goes, meaning every log, index and export the feature creates, which is a personal data discovery problem before it is a policy one. What your model vendor retains and for how long, which is a data processing agreement question and not a product question. Whether any output drives a decision about a person, because that is what triggers California's ADMT rules. And whether your discovery process can find the person in all of those places when a request arrives, because that is the part that fails quietly.
Does the CCPA cover AI and automated decisions?
It does now. The CPPA regulations took effect on January 1, 2026, and businesses using automated decisionmaking technology for significant decisions must comply from January 1, 2027. ADMT means technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. Significant decisions are those resulting in the provision or denial of financial or lending services, housing, education, employment or compensation, or healthcare. Consumers get a pre-use notice, an opt-out subject to exceptions, and a right to access how the decision was made about them.
Is using ChatGPT or another model provider a privacy risk for my company?
The risk is rarely the model. It is the retention terms and the record you keep. Your provider is a processor or a service provider, so what it holds, for how long, and which of its own subprocessors touch it are contract questions you should be able to answer from the data processing agreement rather than from a support ticket. If you cannot state the retention window today, you cannot promise a requester a deletion date, and that gap shows up on a 45-day clock rather than in a security review.
Run a data subject access request end to end
Obtainer finds where a person's data lives across your systems, compiles it into one manifest, drafts the deadline-safe response, and tracks the GDPR and CCPA clock. You review, redact, and approve what gets disclosed. Helps you comply; not legal advice.