Carry GDPR obligations through every copy

Learning objective

Apply GDPR obligations — lawful basis, purpose limitation, minimization, retention, deletion, and data-subject rights — to prompts, logs, memory, and stored outputs.

Core idea

Personal data remains governed when you move it from a source record into a prompt, generated summary, memory entry, or debugging log. Apply the General Data Protection Regulation (GDPR) to the processing activity and its copies, rather than treating the model endpoint as the entire activity.

GDPR Article 5 establishes purpose limitation, data minimization, storage limitation, and accountability. Article 6 requires a lawful basis. Translate the privacy team’s interpretation into input selection, purpose-specific storage, retention schedules, and a rights workflow that reaches derived records. The organization’s compliance and legal owners determine applicability, lawful bases, exceptions, and acceptable transfers; the design implements and demonstrates those decisions.

How it works

Approve the purpose before constructing the prompt

Record what the feature does, whose data it processes, why each data category is necessary, and the Article 6 basis approved for that purpose. Consent is one possible basis, not the automatic answer for every AI feature. If processing involves special-category data, Article 9 adds conditions; an Article 6 basis alone does not settle that processing.

Separate operational assistance from evaluation reuse. A complaint collected to resolve a customer dispute does not become unrestricted prompt-development material. Article 5(1)(b) addresses incompatible further processing, and Article 6(4) provides a compatibility assessment where applicable. Route a proposed reuse to the privacy owner rather than letting a developer’s export create the purpose decision.

A proposed purpose register can identify the allowed input fields, approved readers, permitted downstream uses, retention schedule, and basis decision. Enforce those choices in request assembly and dataset selection. The register is an application governance artifact, not a special Claude API parameter that makes processing lawful.

Minimize before data leaves the source

Article 5(1)(c) requires personal data to be adequate, relevant, and limited to what is necessary. Select fields before assembling the prompt; remove unnecessary identifiers from free text as well as structured columns. A prompt instruction asking Claude to hide names operates after disclosure and cannot undo that disclosure.

Use a separately protected lookup when the workflow needs to reconnect a summary to its source. Under Article 4(5) and Recital 26, pseudonymized data remains personal data when additional information can attribute it to a person. Replacing a name with a customer token therefore does not automatically remove GDPR obligations. Context can also identify someone without a direct name.

Inspect tool results and memory writes at the same boundary. A minimal initial prompt followed by an unrestricted customer-history lookup defeats the initial field selection. See 5.1.1 for control placement; the privacy-specific question is whether each retrieved or persisted field remains necessary for the approved purpose.

Give each copy its own retention rule

The lifecycle inventory should make four surfaces explicit:

These controls implement an approved schedule; GDPR does not prescribe one universal number of days for every AI record. Article 5(1)(e) ties identification to necessity for the purpose, subject to the conditions it states. The privacy owner decides the schedule and exceptions; a data owner operates expiry and verifies the result.

Anthropic’s API and data-retention documentation distinguishes zero data retention (ZDR), HIPAA readiness, and feature-specific storage. ZDR is an arrangement with eligibility conditions, not a promise that every API feature rejects storage. Noneligible features are not automatically blocked under ZDR; using them places that data outside the arrangement. Legal or trust-and-safety retention exceptions also matter. Record the selected model and feature’s documented handling rather than applying one retention label to the whole platform.

Covered Models — Claude Fable 5.1, Claude Mythos 5.1, Claude Fable 5, and Claude Mythos 5 — require 30-day retention and are unavailable under ZDR unless Anthropic expressly authorizes it. For Claude Fable 5 on the Claude API, an organization without the required retention enabled receives 400 invalid_request_error. Batch processing (/v1/messages/batches) has 29-day retention; the memory tool uses client-side storage whose retention you control, so its expiry and erasure operations must reach your own store.

Make rights executable across derived data

Article 15 provides access; Article 16 addresses rectification; Article 17 addresses erasure; Article 18 addresses restriction. Article 20’s portability right and Article 21’s right to object have their own conditions. Build a rights-request case that records identity verification, scope, applicable right, deadline, decision owner, affected stores, and completion results. These are proposed workflow fields, not API field names.

Article 12(3) requires information on action taken without undue delay and generally within one month of receipt. It permits an extension of two further months where necessary, considering complexity and number of requests, with notice within the first month explaining the delay. An engineering backlog does not silently extend that deadline.

Use subject-to-artifact associations to find copies without putting a direct identifier in every log. On rectification, correct the source and address inaccurate personal data in stored summaries or memory; replacing a prompt template does not correct a stored assertion. On restriction, prevent the prohibited processing while retaining data where the applicable decision requires it. On erasure, propagate the approved action through live stores, derived retrieval data, and processor requests; see 3.5.4 for index lifecycle mechanics.

Article 17(3) includes exceptions, such as necessary processing for a legal obligation or legal claims. Do not promise unconditional deletion. Record the approved exception, restrict access and use accordingly, and address backup restoration in the deletion design so a restore does not silently reintroduce erased live records. Article 19 also requires communication of rectification, erasure, or restriction to recipients unless impossible or disproportionate, and information about recipients to the data subject on request.

Key distinctions and trade-offs

No training versus no retention: A training commitment does not establish the lifetime of files, logs, memory, or outputs. Evaluate each stored copy and the feature that created it.

Erasure versus restriction: Deleting everything can conflict with a justified retention obligation; retaining everything can defeat an applicable erasure right. The privacy decision determines the action, and the system records its completion.

Personalization versus minimization: Persistent memory can improve continuity while widening purpose and rights handling. Save only justified facts and make their retrieval, correction, and expiry operable.

Architecture / decision scenario

An EU retailer wants a returns assistant ready in eight weeks. The proposed design saves all conversations permanently to improve personalization and copies them into evaluations. The privacy lead has approved returns handling, but has not approved that evaluation reuse or indefinite memory.

The architect selects purpose-scoped memory and a privacy-approved retention schedule. Input assembly sends order facts needed for the return, while logs retain operational identifiers under their own schedule. Stored summaries remain associated with the customer through a restricted lookup. The privacy lead records the lawful basis and determines whether evaluation reuse is compatible; synthetic cases serve evaluation until that decision is complete.

A customer then requests access, correction of an inaccurate summary, and erasure of unnecessary chat history. The case owner applies the one-month workflow, locates prompts retained for diagnostics, memory, logs containing personal data, and stored outputs, and obtains the privacy decision on records that must remain. The team corrects the summary, deletes eligible copies, communicates required recipient actions, and records exceptions and results. Deleting the source conversation alone would leave the memory error intact.

Common exam traps

• Assuming every processing activity requires consent or that consent settles special-category processing.
• Treating a customer token as proof of anonymization.
• Applying deletion only to the source database.
• Assuming ZDR automatically blocks every noneligible feature.
• Promising unconditional erasure or ignoring recipient notifications.

What to remember

Give every prompt, log, memory entry, and output a justified purpose and lifecycle. Make rights executable through subject-to-artifact associations and owned cases. Vendor retention terms address the vendor’s handling; they do not erase the copies your organization stores.

Knowledge check

References

• European Union, Regulation (EU) 2016/679 (General Data Protection Regulation)
• Anthropic, API and data retention