GDPR and AI models: can personal data be erased from a trained model?
Someone asks you to delete their data and it turns out to be in the dataset a model was trained on. Do you have to “un-train” it? The honest answer is that it depends on the case and on whether the model can be considered anonymous. Here is the framework and what you can do today, without jargon.
The problem, with an analogy
Imagine a cook who learns a recipe by reading a thousand family notebooks. If one family asks for their notebook to be destroyed, it is easy to take it off the shelf. What is hard is “unlearning” what has already shaped the cook’s style. AI models work similarly: deleting a record from the dataset does not always remove its influence from the trained model.
What the GDPR says
- Erasure (Art. 17): a person can ask for their data to be deleted when, for example, it is no longer necessary, they withdraw consent or they object, subject to exceptions in the Regulation.
- Deadline (Art. 12(3)): you must reply within one month, extendable in complex cases with notice.
- Minimization and accuracy (Art. 5): data must be necessary and up to date; it is far easier to comply by design than to fix later (Art. 25).
What the EDPB said in Opinion 28/2024
At the request of the Irish authority, the European Data Protection Board examined three questions on AI models. In short and without legal nuance:
- Is a model trained on personal data anonymous? Not always. It must be assessed case by case whether it is very unlikely to extract personal data from the model and obtain it through queries.
- Can legitimate interest be used? It can be a possible basis for development and deployment, after a three-step assessment (legitimate interest, necessity and balancing), with safeguards and attention to people’s reasonable expectations.
- What if the model was trained on unlawfully processed data? It can affect the lawfulness of later use, depending on the circumstances and on whether the model became anonymous before deployment.
If your case is relevant, read the original opinion and consult a data protection professional.
Technical options that exist (today)
- Act on training data: remove the person’s data from datasets and exclude it from future cycles.
- Retrain or fine-tune: in the next cycle, without the data. It is costly, so plan for it.
- Input and output filters: stop the system returning specific personal data. They reduce risk but do not “delete” anything from the model.
- Machine unlearning: an active research line; do not assume it is solved or promise it to third parties without verifying it.
- Anonymize before training: the best preventive measure; see our guide on anonymization and pseudonymisation.
How to prepare: a five-step procedure
- Document which data goes into each model (source, legal basis, categories) in your records of processing and your AI systems inventory.
- Assess impact where relevant: see when a DPIA is required.
- Define the channel and the owner for erasure requests that touch AI.
- Decide in advance what you will do (deletion in data, filters, retraining calendar) and write it down.
- Ask your vendors about their training data and how they handle these requests; see the guide on AI vendors.
Frequently asked questions
Can a person have their data erased from a model?
The right to erasure exists with exceptions; applying it to already-trained models needs a case-by-case analysis.
Can a data point be removed from a model?
There is no mature general solution; you act on training data, filters and retraining.
What do I do when I receive a request?
Follow a documented procedure and answer within one month.
Informational and indicative content; it is not legal advice. Review your case with a qualified professional.
What's your Data Governance maturity?
Free assessment with your priority gaps and the templates on the Data Governance path.