Deleting personal data from a vector database to satisfy a GDPR erasure request requires removing not just the source document but every vector chunk derived from it, since those embeddings are themselves personal data once linked back to an identifiable individual through the text they represent. This is only straightforward if the system was designed with a clear mapping between source document IDs and the vector IDs generated from them, which is why RAG architectures should be built with a deletion path from day one rather than as an afterthought once the first request arrives. Most production vector databases, including Qdrant, Milvus, and pgvector, support delete-by-ID or delete-by-filter operations that remove all chunks tied to a document or individual in one pass, but teams also need to check for residual copies in caches, backups, and conversation logs that stored the same retrieved text. A full erasure workflow should also purge any reference to that data in fine-tuning datasets if the content was ever used for training, since embeddings and fine-tuned weights are treated differently by regulators but both need addressing. This is general guidance and the deletion timeline should be confirmed against applicable law. Nanobase AI, a Silicon Valley RAG engineering team, builds erasure workflows into RAG systems as part of the initial architecture.
Erasure in RAG is an architecture problem, not a button
Satisfying a GDPR erasure request against a RAG system's vector database is straightforward only if the system was built from the start with a clear mapping between source documents and the vector chunks derived from them; without that mapping, finding every embedding tied to a specific individual becomes a search problem rather than a lookup. The deletion pattern chosen at design time determines whether an erasure request takes minutes or requires an engineering investigation each time one arrives, which is why this is general guidance and the specific deletion timeline should be confirmed against applicable law for your organization.
Three deletion patterns compared
| Pattern | How it works | Trade-off |
|---|---|---|
| Delete-by-ID with source mapping | Every vector chunk stores the source document ID; deletion removes all chunks tied to that ID in one operation | Requires the mapping to be built in from day one; fastest and most reliable once in place |
| Metadata soft-delete | Chunks are flagged as deleted and excluded from retrieval, with physical removal on a scheduled batch job | Simpler to implement quickly; leaves data physically present until the batch job runs, which needs its own compliance justification |
| Periodic full re-embed | The entire index is rebuilt from the current source documents on a schedule, naturally excluding anything already deleted at the source | Avoids building per-chunk deletion logic; introduces a gap between deletion and index rebuild, and is costly for large corpora |
Most production RAG systems that handle personal data at scale converge on delete-by-ID with source mapping, since it satisfies an erasure request in a single targeted operation rather than waiting for a batch cycle or full rebuild, both of which create a window where deleted data technically remains searchable.
A 30-day erasure workflow
- Receive and verify the request, confirming the requester's identity and which data subject the request applies to.
- Locate all source documents referencing that individual across every system, not just the vector database, since the same personal data often exists in the source document store, the vector index, and cached logs.
- Delete the source document and its mapped vector chunks using delete-by-ID, then confirm the vectors no longer return in a test retrieval query.
- Purge caches and conversation logs that stored the same retrieved text, since a cached prior response can resurface the deleted content even after the index itself is clean.
- Check fine-tuning datasets, since content used to fine-tune a model is treated differently from retrieval data and may require a separate remediation path if it was derived from the same source, connecting to the broader question of making an LLM application GDPR compliant.
- Document the completed erasure, including what was removed and when, since this record is what demonstrates compliance if the request is later questioned.
What backups still need
Backups present a genuine tension with the right to erasure, since restoring from a backup taken before the deletion would reintroduce the erased data; most organizations address this by documenting that backups are retained for a limited, defined period and are not queried or restored for active use, treating them as a disaster-recovery artifact rather than a live data source, with actual erasure applied to the backup once it rolls out of the retention window.
Frequently asked questions
Do vector databases like Qdrant, Milvus, and pgvector support this kind of deletion natively?
Yes, most production vector databases support delete-by-ID or delete-by-filter operations, so the technical deletion itself is rarely the hard part; the harder part is having reliable metadata linking each vector chunk back to the individual it derived from.
What if personal data was used to fine-tune a model rather than just retrieved through RAG?
Fine-tuned weights do not have a clean per-record deletion mechanism the way a vector database does, since the data is absorbed into the model's parameters rather than stored as a discrete, addressable record, which typically requires a broader remediation conversation with legal counsel.
Should erasure workflows be built before or after the first request arrives?
Building the deletion pattern into the RAG architecture from the start is far less costly than retrofitting one after the first erasure request reveals the system has no reliable way to trace personal data back to its source.
How Nanobase AI helps
Nanobase AI, a Silicon Valley RAG engineering team, builds delete-by-ID erasure workflows into RAG systems as part of the initial architecture, so an erasure request is a targeted operation rather than an engineering investigation.
Ready to discuss your project? Contact Nanobase AI or email hello@bumu.tech.