GDPR Erasure Request Response Template for AI Training Data

When someone submits an Article 17 erasure request for data used in training an AI model, your legal team needs a clear response framework. This template guides you through deciding whether to honor, decline, or negotiate the request.

Purpose of This Template

This framework helps you assess erasure requests based on GDPR Article 17's conditions for deleting AI training data. Use it to:

• Determine if your lawful processing basis requires erasure
• Document your legal reasoning for audits
• Draft a compliant response to the data subject
• Identify when you can decline the request

Ensure you've verified the requester's identity and confirmed their data is in your training set.

Prerequisites

Before using this template, gather:

• Your legal basis for processing (Article 6(1)(a)-(f)): consent, contract, legal obligation, vital interests, public task, or legitimate interest
• Your Data Protection Impact Assessment for the AI training
• Retention schedules for the dataset
• Legal obligations requiring data retention (e.g., financial records, litigation holds)
• Data source: directly collected, public sources, purchased, or partner-transferred

If relying on legitimate interest with publicly sourced data, note that authorities like the Garante Per La Protezione Dei Dati Personali suggest this may be the only lawful purpose for web-scraped AI training data.

The Evaluation Template

ERASURE REQUEST EVALUATION
Request ID: [Internal tracking number]
Date Received: [Date]
Data Subject: [Identifier - do not include PII in this template]
AI System(s): [Model name/version trained with this data]

STEP 1: LAWFUL BASIS CHECK
What is your documented legal basis for processing this data?
☐ Article 6(1)(a) - Consent
☐ Article 6(1)(b) - Contract performance
☐ Article 6(1)(c) - Legal obligation
☐ Article 6(1)(d) - Vital interests
☐ Article 6(1)(e) - Public task
☐ Article 6(1)(f) - Legitimate interest

If CONSENT is your sole basis:
→ ERASURE REQUIRED (Article 17(1)(b))
→ Skip to Step 4

If LEGITIMATE INTEREST:
→ Proceed to Step 2

If any other basis:
→ Proceed to Step 3

STEP 2: LEGITIMATE INTEREST BALANCING TEST
(Complete only if Article 6(1)(f) applies)

Your documented legitimate interest:
[Describe: e.g., "Improving fraud detection accuracy to protect customers"]

Data subject's objection grounds:
[Quote from their request]

Balancing assessment:
Does your interest demonstrably override the data subject's rights?
☐ Yes - Document why below
☐ No - ERASURE REQUIRED (Article 17(1)(c))

If YES, explain overriding factors:
[Example: "Data is fully anonymized in deployed model; erasure would require 
retraining at €X cost with no privacy benefit to requester"]

STEP 3: UNLAWFUL PROCESSING CHECK
Is the processing currently lawful under GDPR?
☐ Yes - Proceed to Step 4
☐ No - ERASURE REQUIRED (Article 17(1)(d))

If NO, specify the compliance gap:
[Example: "Purpose limitation violation - data collected for customer service, 
used for marketing model training without additional consent"]

STEP 4: OTHER ARTICLE 17(1) GROUNDS
Does any of the following apply?

☐ Data no longer necessary for original purpose (Article 17(1)(a))
☐ Legal obligation requires erasure (Article 17(1)(e))
☐ Data collected from child <16 for information society service (Article 17(1)(f))

If any box checked: ERASURE REQUIRED

STEP 5: EXEMPTION CHECK
Can you invoke an Article 17(3) exemption?

☐ (b) Compliance with legal obligation requires retention
   Specify obligation: [e.g., "7-year financial records retention under [Member State law]"]

☐ (e) Establishment, exercise, or defense of legal claims
   Specify claim: [e.g., "Data subject in active litigation regarding this service"]

If exemption applies: ERASURE DECLINED

STEP 6: DECISION
Based on the above:
☐ HONOR ERASURE REQUEST - Proceed to deletion protocol
☐ DECLINE ERASURE REQUEST - Draft exemption explanation
☐ PARTIAL COMPLIANCE - Erase from training set, retain under exemption for [specify purpose]

Response due date: [30 days from receipt per Article 12(3)]
Assigned to: [Team member]

Customizing the Template

For consent-based processing: If data was collected with specific consent for AI training, delete it when consent is withdrawn unless another legal basis applies.

For legitimate interest: Customize Step 2 with specifics. Document the measurable benefit to your organization or third parties and the privacy impact on the requester. For publicly scraped data, this balancing test is crucial as consent is often not feasible.

For multi-purpose datasets: If data supports AI training and another purpose with a different legal basis, mark "PARTIAL COMPLIANCE" and specify which activities will cease.

For child data: If AI training involved services offered to children, Article 17(1)(f) and Article 8(1) create a heightened erasure obligation. Flag these requests for immediate legal review.

Validation Steps

Before sending your response:

1. Cross-reference your DPIA: Ensure your legitimate interest in the impact assessment matches Step 2. Inconsistencies suggest an outdated DPIA or unclear legal reasoning.

2. Check your retention schedule: If claiming a legal obligation exemption under Article 17(3)(b), verify the specific Member State law and confirm the retention period hasn't expired.

3. Review your consent records: If relying on consent, check the original consent timestamp and language. Confirm you asked for consent to AI training.

4. Test your "overriding interest" claim: If declining based on legitimate interest, argue the opposite position. If you can't justify why the data subject's rights don't override your interest, your justification isn't strong enough.

5. Verify deletion feasibility: Confirm with your ML engineering team whether you can remove individual records from the training set or need to retrain. Document the technical approach in your response.

This template creates an audit trail. If a supervisory authority questions your decision later, you'll have contemporaneous documentation of your legal reasoning.

GDPR Article 17