How do I make sure an AI supplier really deletes our data when we leave?

You cannot independently prove that every physical copy has vanished from a supplier's infrastructure simply by looking at its dashboard. What you can do is require a specific deletion commitment, check the evidence against your data inventory and close any unexplained gaps. A cancellation email or an empty workspace is not enough. Neither is a generic security certificate that says nothing about your account.

Ask for a dated completion record naming your organisation, the account or tenant identifiers, the deletion instruction, the systems covered and the person or function accountable for the confirmation. It should distinguish completed deletion from outstanding scheduled deletion. Where information remains, require the reason, access restrictions and a definite deletion date or clearly described retention trigger. A certificate without scope or exceptions is much less useful than a plain written response that explains both.

Include uploaded files, prompts, conversation history, generated outputs, assistant memories, search indexes, embeddings, application logs, support attachments and copies held by other processors. Whether a particular derived record is personal data depends on its content and context; do not assume a technical transformation makes it anonymous. Commercially confidential material also needs protection even where it is not personal data.

For a small UK business, the practical buying decision is whether the supplier can explain and evidence its exit process before it receives sensitive information. If it cannot, choose a less sensitive use case, another provider or a workflow that keeps the documents in your existing controlled systems. Buying more software is not the only answer.

For personal data processed on your behalf, ICO guidance on controller and processor contracts explains the Article 28(3)(g) requirement: at the end of the contract, the processor must, at your choice, delete or return the personal data and delete existing copies unless UK law requires storage. Returning an export does not by itself settle what happens to the supplier's remaining copies.

Turn that requirement into an operational agreement. Specify how you issue the instruction, which accounts and services it covers, the export format, when access ends, how live-system deletion is confirmed and how remaining backup copies are controlled. Ask whether export or assisted deletion attracts an additional charge. Get any charge agreed in pounds before committing; there is no honest universal market price for this work.

The same ICO guidance explains that Article 28 obligations must flow down to sub-processors and that the processor remains liable to the controller for their compliance. Your AI application supplier may rely on a model provider, cloud host, logging platform and support system. Request a response that covers that chain rather than only the application database.

Keep the supplier's role precise. It may process customer documents on your instructions while handling billing records for its own purposes. Different processing activities can have different legal roles. Do not accept a blanket statement that every record is exempt from deletion because the supplier needs to retain invoices. The ICO flags this guidance as under review following the Data (Use and Access) Act, so check the current text and obtain specialist advice for disputed or sensitive processing.

Yes, some retention can be legitimate, but the exception must be specific. The ICO's right-to-erasure guidance describes backup data being put beyond use until overwritten under an established schedule. Its end-of-contract guidance also recognises that immediate backup deletion may not always be possible, provided appropriate safeguards and an appropriate retention period apply. This is not permission to keep using old customer information indefinitely.

Ask what beyond use means in this service: who can access the backup, whether it is isolated from ordinary processing, when it expires and what happens after a disaster recovery restore. The supplier should explain how previously deleted data will be prevented from returning to normal use after restoration. A deletion process that forgets recovery copies is incomplete.

The ICO gives a concrete UK example: an employer can retain information needed to meet its obligation to disclose salary details to HMRC, despite an erasure request from a former employee. It also gives a healthcare-provider example involving retention of patient records for the establishment, exercise or defence of legal claims. These illustrate why erasure is not absolute; they are not AI suppliers' permission to retain every uploaded document.

Ask the supplier to identify the category retained, the applicable obligation or other justification, the minimum necessary scope and the retention period. Distinguish a statutory obligation from a contractual preference or a vaguely stated possible future need. Where a legal hold applies, request the documented basis and review arrangements without demanding disclosure of privileged advice. Keep the unresolved exception on your exit record rather than marking everything deleted.

Deleting a document from a knowledge base is not the same technical operation as removing its influence from model weights. If a supplier used your information to train or fine-tune a model, ask exactly what happened and what remedy is technically available. Do not accept a promise that cancelling the subscription automatically reverses training. Do not assume it is impossible in every case either: the answer needs evidence about the actual system.

For future procurement, separate service delivery from optional model improvement. Establish whether your files, prompts and outputs may be used for training, which contractual terms apply and what administrators can enforce. Microsoft 365 Copilot, ChatGPT business offerings and a custom hosted assistant have different product architectures and agreements. A business label alone does not establish an identical deletion or retention policy. Compare the specific service and contract, not the brand.

Assistant memory, retrieval indexes and generated summaries deserve explicit questions because staff can mistake removal of the original upload for removal of all useful copies. Ask how deletion propagates and whether previously generated outputs remain in shared workspaces. Remove unnecessary copies in your own CRM, shared folders and exports as well; the supplier cannot delete files your staff downloaded to their laptops.

Finally, revoke the supplier's access to your systems. Remove OAuth connections, service accounts and webhooks, rotate relevant credentials through your approved process and disable scheduled imports. Otherwise the supposedly departed assistant may ingest the same information again. Revocation prevents new access; it does not prove old copies were deleted. You need both controls.

Start with a non-sensitive test record before the real exit. Give it a distinctive identifier, place it in the agreed parts of the workflow and ask the supplier to demonstrate the deletion process. Then check that authorised search, retrieval and export functions no longer return it. Never put a real client secret into a test just to make it memorable.

This test checks visible behaviour, not every storage device. Pair it with the supplier's written confirmation, relevant audit information and contractual rights. Article 28(3)(h), as explained by the ICO, requires the processor to provide information needed to demonstrate compliance and allow for and contribute to audits and inspections. That does not mean every small customer must commission a bespoke infrastructure audit for every low-risk subscription.

Increase scrutiny when the service holds confidential client files, health information, employee records or large volumes of personal data. Ask your privacy or legal adviser to assess unresolved restrictions on evidence or audit access. For a low-risk assistant using public documents, a documented review and scoped supplier confirmation may be proportionate. For sensitive processing with an unexplained retention policy, it may not be.

Assign one person to close the exit. They should check that the returned export opens, the new system has what it needs, live access is revoked and outstanding retention dates have follow-up owners. Keep evidence without unnecessarily preserving the sensitive data you intended to remove. If a supplier misses its commitment, escalate through its contractual support and complaints route; assess separately whether any incident triggers your own data protection duties.

This is an assurance framework for choosing or leaving a supplier, not a forensic guarantee or a substitute for legal advice. If you suspect unlawful retention, a breach, a legal dispute or a conflict with a client confidentiality agreement, involve the appropriate specialist before making further deletion demands. Preserving necessary evidence may matter, and deleting the wrong material can make the problem worse.

For a public-information tool with no personal data or confidential uploads, do not turn a simple cancellation into an expensive compliance project. Check account closure, payment cancellation and any relevant contractual obligations, then document the proportionate decision. Equally, do not assume a purely local model needs no deletion work: hosting logs, backups and local copies can still exist.

If a supplier cannot explain where your information goes or what remains after exit, you do not have to proceed with that sensitive use case. A conventional search tool, an existing document-management system or a human-controlled workflow may meet the need with fewer exposures. If you want help comparing the evidence, bring the supplier's processing terms, sub-processor list and proposed exit confirmation to a conversation. Those documents are more useful than another demonstration.