# AI erasure request evidence map

Synthetic request ERASURE-TEST-01. No live data has been searched, deleted, retained under a legal hold or sent to a provider.

An invented requester’s information appears in a support record and several AI-related copies. Each row identifies a distinct action and the evidence needed.

| Location | Action to assess | Evidence and owner |
| --- | --- | --- |
| Original support record | Apply the organisation’s Article 17 decision to the source record. | Privacy decision and source-system action record; support-system owner. |
| ChatGPT conversation | Use the applicable conversation deletion control if erasure is required. | Correct account/conversation and action confirmation; workspace owner. |
| File saved to Library | Assess and remove the saved file separately where required. | File identity and confirmation; file/workspace owner. |
| Project file or saved memory | Review its separate storage and deletion control. | Relevant object and actual action; authorised workspace user or administrator. |
| Draft copied into a document | Assess this separate retained copy. | Document owner’s confirmation and scope; collaboration-system owner. |
| Exported security evidence | Determine necessity, erasure or applicable retention exception. | Reasoned privacy/legal decision and access restriction; security record owner. |
| Request response | Reconcile confirmed actions and explained exceptions. | Clear response and case record; privacy operations. |

## Review steps

- Map all relevant copies: Use the actual account, surface, feature and saved locations rather than assuming one conversation contains everything.
- Separate legal and technical status: Record the erasure decision, any justified exception and whether the action is requested, completed or scheduled.
- Reconcile before replying: Check recipient communications, provider responses and the Article 12 response timeline.

## Example case record

Reference: ERASURE-TEST-01
Requester: fictional customer Example Person
Receipt date: not a real request
Legal assessment: illustrative only; no live Article 17 determination
Action status: not performed
Response: not sent

## Practice response outline

Identify the request scope, explain the action actually taken, describe any justified retained records and reasons, and give the relevant rights information. Do not claim every copy was removed when confirmations cover only selected locations.

## Source and scope

Guide: https://aona.ai/resources/guides/gdpr-ai-chat-deletion-requests/

Source check: 21 September 2026. General information; no professional approval or installed-product result is represented.

- EU GDPR: Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- OpenAI: ChatGPT Work Cloud data handling and retention: https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security#data-handling-and-retention