How do we handle access and erasure requests when data has been in an AI?
Short answer
People have the right of access to the data you hold about them (Article 15 GDPR) and, in some cases, the right to erasure (Article 17). This also covers prompts, answers and reports where AI was used. You must reply without undue delay and within one month at the latest. It is far easier when the AI service has only seen pseudonyms: the real data is kept in one place with you, and deleting the key removes the link.
Why pseudonymisation helps
Without pseudonymisation, a person's name can sit in a hundred conversations in an AI service that you cannot search. With GoalCube, the real data is kept together in the EU, the AI has only seen codes, and you can find everything about one person in one place.
What to do
- Confirm the person's identity.But don't ask for more than you need.
- Find the data everywhere.Including in AI reports, decisions and logs.
- Explain automated decisions.If AI played a part in a decision, you must explain the logic.
- Reply within one month.The deadline can be extended by two months in complex cases, but the person must be told.
- Delete when there is no basis.And remember the AI service's history.
What the law says
- Articles 12 and 15 GDPR – right of access
- One-month deadline; information about automated decisions.
- Article 17 GDPR – right to erasure
- The ‘right to be forgotten’, with exceptions.
- Article 86 AI Act
- Right to an explanation of the AI's role in decisions made with high-risk AI.
Questions and answers
Do we need to delete data at OpenAI or Anthropic?
Yes, if they hold personal data you must delete. With pseudonymisation they only have codes – and the codes mean nothing without the key you keep.
What about the audit log?
A log of decisions may have a basis for being kept, for example as documentation. Assess this in your retention policy.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.