What it means
- Use only the data an AI system actually needs, keep it only as long as needed, and delete it properly afterwards.
- Applies to training datasets, test sets, prompts and chat logs, retrieval indexes, and copies held by AI vendors.
- Use masking, pseudonymisation or synthetic data where real identities are not needed.
Why it matters
- The DPDP Act requires personal data to be erased once its purpose is served; RBI FREE-AI ties AI data lifecycle to DPDP.
- AI projects tend to hoard data "just in case"; every extra copy is extra breach exposure.
- Chat logs from GenAI assistants often contain sensitive data nobody planned to keep.
Checklist
- For each AI system, list the data fields used and justify each; drop fields that add little.
- Mask or pseudonymise personal data in training and test environments where possible.
- Set retention periods for training data, prompts and outputs, chat logs and vector indexes; add them to the retention schedule.
- Configure AI vendor settings for zero or limited retention where available, and confirm in contract.
- Automate deletion jobs and record their runs.
- Handle deletion requests from individuals across AI datasets as well as core systems.
Evidence examples
- Feature justification sheet for the credit model showing fields removed.
- Retention schedule extract covering AI chat logs and training data.
- Deletion job logs or certificates of deletion for retired datasets.
- Vendor console screenshot or contract clause showing zero data retention for the LLM API.
- Masking configuration for the model training environment.
Common pitfalls
- Keeping full production copies in data science sandboxes indefinitely.
- Forgetting chat logs and vector databases in the retention schedule.
- Assuming the vendor deletes prompts when the default setting keeps them for 30 days or more.
Satisfies
- BindingEU AI Act
- BindingNYC Local Law 144 (AEDT)
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- VoluntaryRBI FREE-AI
Also relevant to
- ICMR AI in Healthcare Guidelinesno numbered obligations; mapped in its practical notes (access and deletion)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- A.7.2 Data for development and enhancement of AI systems
- A.7.3 Acquisition of data
ISO/IEC 27001
- A.5.33 Protection of records
- A.5.34 Privacy and protection of PII
- A.8.10 Information deletion
- A.8.11 Data masking
SOC 2
- P3.1
- P4.2
- P4.3
- C1.1
- C1.2
Key takeaways
- Collect less, keep less, delete on schedule, including prompts, logs and vendor copies.
- Strong reuse from ISO 27001 (A.5.33, A.5.34, A.8.10, A.8.11) and SOC 2 privacy and confidentiality criteria; add AI-specific data stores to existing schedules.
- ISO 42001 has little direct content here; your privacy programme carries most of the weight.