Prompt & conversation retention/leakage
Privacy & Data ProtectionDescription
User prompts/conversations are logged, retained, or sent to third-party providers, creating leakage and compliance exposure.
Customer chat data is sent to an external LLM provider that retains it for training, breaching DPDP.
The Italian Data Protection Authority (Garante) suspended ChatGPT in 2023 partly on grounds that OpenAI could not demonstrate a technically valid erasure mechanism for personal data embedded in model weights — confirming the technical inability is a real compliance gap in production AI. Machine unlearning methods exist but remain unreliable, and no financial-sector AI system has been confirmed to satisfy GDPR Article 17 at the model-weight level.
Primary mitigations
- Data residency & no-train guarantees
- retention limits
- PII redaction before logging
- tenant-controlled retention
- encryption.
Detection signals
Retention-policy audits; third-party data-flow review; PII-in-logs scanning.