A customer asks you to delete their data or stop using it in your AI tools: a GDPR erasure (Article 17) and objection (Article 21) request sheet for small EU businesses
What you get: a finished request sheet with one row per request: a request log (date, deadline, identity check, ground, exception, extension, reply, proof), a grounds table with AI-tool examples for each ground in Article 17(1) and Article 21, a search list of the places AI tools keep personal data, a supplier line for Article 19, and three reply texts to copy: done, need more time, and refused.
The short answer
When someone asks you to delete their data (Article 17) or to stop using it (Article 21), reply without undue delay and at the latest within one month (Article 12(3)). Check which ground applies and whether an exception in Article 17(3) lets you keep some data. Search every AI tool, transcript, recording and supplier log, tell each recipient of the data (Article 19), and keep a short written record of what you decided and why. An objection to direct marketing must always be followed (Article 21(3)).
Table 1: the request log (one row per request)
| Field | What to write |
|---|---|
| Request ID and date received | R-001 · [date]. The one-month clock starts on receipt (Article 12(3)). |
| Who asked and how you checked identity | [name, channel]. Ask for more information only if you have reasonable doubts about identity (Article 12(6)). |
| What they asked for | Erasure (Article 17) / objection (Article 21) / both. If unclear, ask which data; they can first ask for a copy (Article 15). |
| Ground that applies | Article 17(1)(a)-(f), or Article 21(1) / 21(2) (see table 2). |
| Exception checked | None / Article 17(3)(b) legal obligation / 17(3)(e) legal claims / other. Write the reason; involve whoever decides legal questions. |
| Restriction while you decide | Yes/no. Article 18(1)(d): during an Article 21(1) objection the person can ask you to restrict processing until you have checked whose grounds prevail. |
| Places searched (table 3) | Ticked list with the date each was done. |
| Suppliers told (Article 19) | [supplier, date, their confirmation]. |
| Extension | None / +2 months, reasons sent on [date], within the first month. |
| Reply sent and outcome | [date] · done / partly / refused with reasons and complaint rights (Article 12(4)). |
| Proof kept | Supplier confirmation, screenshot, ticket number. No copy of the deleted data itself. |
The EDPB's report on its 2025 coordinated enforcement action on the right to erasure (adopted 10 February 2026; 32 authorities, 764 controllers) found that many controllers, especially small ones that rarely get requests, had no internal procedure. It recommends a documented procedure with clear deadlines and steps, and writing down the reasons when you rely on an exception.
Table 2: which ground applies
| Article | Ground | AI-tool example |
|---|---|---|
| 17(1)(a) | The data are no longer necessary for the purpose you collected them for | Old chatbot transcripts kept 'just in case' after the enquiry is closed |
| 17(1)(b) | They withdraw consent and there is no other legal ground | Recording of a sales call made on consent; AI newsletter personalisation based on consent |
| 17(1)(c) with 21(1) | They object to processing based on legitimate interests (Article 6(1)(f)) and you have no overriding legitimate grounds | AI scoring of support tickets or leads that you run on legitimate interests |
| 17(1)(c) with 21(2) | They object to direct marketing; this objection is absolute (Article 21(3)) | AI-written marketing e-mails, AI audience segments for ads |
| 17(1)(d) | The data were processed unlawfully | Possibly: staff pasted customer data into a personal AI account with no legal basis |
| 17(1)(e) | EU or national law requires erasure | Check your national rules |
| 17(1)(f) | Data of a child collected for an online service under Article 8(1) | Children's accounts on an app with AI features |
Exceptions (Article 17(3)), the ones a small business most often meets: (b) you must keep the data to comply with a legal obligation under EU or national law, for example invoices kept for tax rules; (e) you need the data to establish, exercise or defend legal claims. Apply them only to the data they really cover and delete the rest. If you keep data under an exception, the EDPB report recommends safeguards such as restriction (Article 18) or keeping the data separate.
Objection (Article 21(1)): where you rely on legitimate interests, you must stop unless you can show compelling legitimate grounds that override the person's interests, rights and freedoms, or the data is needed for legal claims. Direct marketing (Article 21(2)-(3)): no balancing; stop using the data for marketing, including AI profiling linked to it. You must tell people about the right to object clearly and separately at the latest in your first communication with them (Article 21(4)).
Table 3: where AI tools keep the data, search all of it
| Place | Where to look | Done |
|---|---|---|
| Website chatbot transcripts | Tool admin: conversation history, exports, analytics | [done / date] |
| AI assistant used by staff (chat history, shared projects, uploaded files) | Each staff account; company workspace | [done / date] |
| AI meeting note-taker: recordings, transcripts, summaries | Tool library; copies sent by e-mail or saved to shared drives | [done / date] |
| AI features in your CRM or helpdesk (summaries, scores, tags) | Contact record, ticket history, custom fields | [done / date] |
| AI marketing tool (segments, generated e-mails, ad audiences) | Audience lists, uploaded customer lists | [done / date] |
| The AI supplier's own logs and retention | Ask the supplier: how long prompts, outputs and logs are kept and how they delete them (Article 28(3)(e) and (g)) | [done / date] |
| E-mail and shared drives | The EDPB found some controllers wrongly treated e-mail as out of scope | [done / date] |
| Back-ups | If you cannot change a back-up, note the request so the data is not brought back on restore (EDPB CEF 2025, Issue 6) | [done / date] |
The EDPB found controllers treating deletion of a user account as erasure while data stayed in internal systems, and some relying on weak anonymisation, such as partial masking, instead of deletion. If you replace data instead of deleting it, make sure the person can no longer be identified.
Step 4: tell the supplier and other recipients (Article 19)
Communicate the erasure to each recipient the data was disclosed to, unless this proves impossible or involves disproportionate effort, and tell the person who those recipients are if they ask (Article 19). Your AI supplier, as processor, must help you answer rights requests where possible (Article 28(3)(e)).
Please delete all personal data relating to [name / e-mail / customer ID] held in [tool] for our account, including conversation history, uploaded files, outputs and logs, and confirm in writing when this is done and when copies in your back-ups will be removed. Our reference: [R-001].
Step 5: three replies to copy
Done:
Thank you for your request of [date]. We have deleted your personal data from [list of tools and records] and asked [supplier] to delete its copies. [We keep your invoices for [period] because [law] requires it; they are not used for anything else.] If you have questions, reply to this e-mail.
Need more time (send within the first month):
We received your request on [date]. Because [reason, for example several systems and suppliers are involved], we need up to two more months and will reply by [date]. [While we check your objection, we have restricted the use of your data.]
Refused, fully or partly (within one month):
We cannot delete [data] because [reason and Article 17(3) point, for example a legal duty to keep invoices under [law] until [date]]. We have deleted [the rest]. You can lodge a complaint with a data protection supervisory authority, for example [your authority], and seek a judicial remedy.
Do this week
- Copy table 1 into a spreadsheet and name one person to handle requests
- Fill table 3 once for each AI tool you use, so you know where to search
- Check each AI supplier's settings and contract for how long prompts, outputs and logs are kept
- Make sure your privacy notice says how to ask for erasure and object, with a contact address
- Test the process once with a made-up request
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 12, 15, 17, 18, 19, 21 and 28) and the EDPB report "Implementation of the right to erasure by controllers" (2025 Coordinated Enforcement Action, adopted 10 February 2026, published 18 February 2026). National rules can add obligations. Checked on 22 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients often get "delete my data" e-mails and do not know what they may keep. Help them list legal retention duties, such as invoices and accounting records, next to each AI tool in their client AI inventory. Stay inside your professional rules and pass contested cases to a privacy professional or lawyer.
Keep the sheet next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once with its supplier, and keep each closed request as an evidence record (without the deleted data).
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then fill this sheet. Related: Article 15 access request sheet · Article 30 records sheet · AI supplier contract clauses · international transfer check sheet.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 12, 15, 17, 18, 19, 21 and 28
- EDPB: Implementation of the right to erasure by controllers, 2025 Coordinated Enforcement Action report (PDF)
- EDPB news, 18 February 2026: challenges hindering the full implementation of the right to erasure
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.