03 · What You Need to Know
Understanding AI Provider Retention and Participant Disclosure
What Is AI Provider Data Retention?
Data retention concerns how long information remains stored or otherwise retained within a processing arrangement.
When researchers submit information to an AI service, the provider may handle different categories of information under different retention conditions.
For example, uploaded documents, conversation histories, operational logs, and account-related records may not necessarily follow identical retention rules.
Some services offer configurable retention or deletion controls, while others operate under contractual or operational conditions that differ by product.
Researchers should verify the specific arrangement rather than rely on generalized assumptions about generative AI.
The relevant question is not merely whether the provider stores information, but what information is retained, for what purpose, for how long, and under whose authority.
Distinguish Research Data Retention From AI Provider Retention
Research institutions may require original data to be retained for legitimate research, auditability, legal, or publication purposes.
For example, a university may require researchers to retain interview transcripts securely for a specified period after study completion.
That obligation is different from the retention of copies submitted to an external AI service.
Institutional research data retention
Retention of research records under the study's approved data management and institutional requirements.
AI provider data retention
Retention of information processed through the external service under its applicable contractual, technical, and legal conditions.
A researcher may legitimately retain original transcripts within an authorized institutional repository while having a separate obligation to limit or manage information retained by an AI provider.
Participants should not be given the impression that these arrangements are identical when they differ materially.
What Information Might an AI Provider Retain?
The information retained depends on the particular service and configuration.
| Information Category |
Possible Retention Consideration |
Question to Verify |
| Submitted prompts |
Text entered into the AI interface. |
Are prompts retained, and for how long? |
| Uploaded research files |
Documents or recordings submitted for processing. |
What retention and deletion rules apply to files? |
| Generated outputs |
Summaries, classifications, and other responses. |
Are outputs stored separately from submitted inputs? |
| Conversation history |
Records visible through the user's account. |
Does deleting a conversation initiate deletion of associated content? |
| Operational logs |
Records maintained for specified service functions. |
What logging and retention conditions apply? |
| Backups |
Copies maintained under applicable recovery arrangements. |
Are backup retention periods different? |
| Subprocessor records |
Information handled by authorized additional providers. |
What deletion and retention obligations apply to subprocessors? |
The table identifies possible categories rather than asserting that every AI provider retains all of them.
Researchers should examine the current provider documentation and applicable agreement to determine which conditions actually apply.
Why Deleting a Conversation May Not Mean Immediate Erasure
Deleting a conversation from an AI interface may remove it from the user's visible history or initiate a deletion process.
However, the provider may operate separate systems for files, logs, backups, or other records, subject to its applicable retention and deletion arrangements.
For example, a provider may specify a period during which certain information remains retained after user-initiated deletion.
Other arrangements may provide different deletion controls or limited retention exceptions.
Researchers should not infer complete erasure merely because the conversation is no longer visible.
At the same time, they should not assume that deletion is ineffective. The actual outcome depends on the provider's verified conditions.
The appropriate disclosure should distinguish user-interface deletion from the provider's underlying deletion obligations.
What Does the GDPR Require About Retention Disclosure?
Under the European Union's General Data Protection Regulation, Articles 13 and 14 establish transparency requirements concerning the period for which personal data will be stored or, where that is not possible, the criteria used to determine that period.
Article 5(1)(e) establishes the storage limitation principle, subject to applicable provisions concerning longer retention for specified purposes, including certain research-related processing with appropriate safeguards.
These provisions do not establish one universal retention period for all AI services or research data.
Where the GDPR applies, the researcher and responsible institution should determine which retention information must be provided and whether the processing arrangement satisfies the relevant requirements.
Researchers should not invent a fixed period simply because a precise number would make the consent form easier to write.
What Does the Philippine Data Privacy Act Require?
In the Philippines, Republic Act No. 10173 establishes principles concerning personal information processing, including proportionality and transparency.
The Act's implementing rules address retention and disposal of personal data in relation to legitimate purposes and applicable requirements.
Section 16 also establishes relevant data subject information rights, including information concerning the period for which data will be stored, subject to the Act's provisions.
For example, a Philippine university researcher using an external AI service may need to examine both institutional research record retention requirements and the provider's retention of submitted participant information.
The appropriate disclosure and safeguards depend on the actual processing arrangement and applicable National Privacy Commission guidance.
Researchers should consult institutional data protection personnel when provider retention conditions are uncertain or potentially inconsistent with research requirements.
Does Data Retention Mean the Provider Uses Information for Model Training?
No. Retention and model training are different processing activities.
A provider may retain information for specified operational or security purposes without necessarily using it to train or improve models.
Conversely, some service arrangements may permit particular forms of model improvement or other secondary processing under their applicable conditions.
Researchers should verify both questions separately.
Data retention
How long information remains stored or otherwise retained under the service arrangement.
Model training or improvement
Whether submitted information may be used for developing, evaluating, or improving AI systems under the applicable conditions.
A statement that data are not used for model training does not necessarily mean they are never retained.
Likewise, the existence of retention does not establish that the information is used for training.
Can a Provider Retain Data Even When Model Training Is Disabled?
Potentially. Some service arrangements distinguish restrictions on model training from retention for other authorized purposes.
For example, a provider may prohibit using submitted content to improve general-purpose models while retaining limited records for specified security or operational functions.
Whether such retention occurs depends on the particular product, configuration, and agreement.
Researchers should therefore avoid promising that participant data are immediately deleted simply because model training has been disabled.
Both the permitted uses and retention conditions should be verified independently.
Should Participants Be Told the Exact Retention Period?
Where the applicable law or institutional requirements call for retention information, researchers should provide the verified period or relevant criteria for determining it.
For example, an agreement may specify a particular period for retaining submitted content, subject to defined exceptions.
In other circumstances, different categories of information may have different retention conditions.
Researchers should not simplify these arrangements into an inaccurate universal statement.
Where a precise period is not available, the researcher should determine whether the applicable framework permits disclosure of retention criteria and whether the service arrangement is sufficiently clear for authorization.
Uncertainty about essential retention conditions should be resolved before submitting protected participant information.
Why Retention Matters to Participant Withdrawal
Participants may have rights or options concerning withdrawal from research or the processing of their personal information.
However, withdrawal from a study does not necessarily result in immediate deletion of every record under every legal or institutional framework.
For example, some research information may need to be retained under legitimate institutional or legal requirements, while data already processed by an external service may be subject to separate deletion arrangements.
Researchers should explain the actual withdrawal and deletion conditions rather than promise that all information can always be erased immediately.
They should also distinguish withdrawal from future participation, withdrawal of research data where permitted, and the exercise of applicable data-protection rights.
These distinctions may be particularly important when participants are offered choices about AI processing.
Can Retained AI Outputs Contain Personal Information?
Yes. AI-generated summaries or classifications may reproduce details from submitted participant information.
For example, an AI-generated interview summary may include a distinctive professional role or institutional event that makes a participant identifiable.
The output may also contain inferred personal characteristics that were not explicitly collected.
Researchers should therefore examine retention and access arrangements for generated outputs as well as original inputs.
The fact that information has been transformed into an AI-generated summary does not necessarily make it anonymous or remove applicable data-protection obligations.
Does De-Identification Eliminate Retention Concerns?
Not necessarily. Removing direct identifiers may reduce privacy risks, but contextual information may still identify participants.
For example, an interview excerpt may omit a participant's name while describing a unique institutional position and a distinctive professional experience.
Retaining that excerpt could still raise confidentiality concerns.
Even genuinely anonymous information may remain subject to institutional or contractual restrictions on research data processing.
Researchers should assess both identifiability and the necessity of retention rather than assume that removing names resolves every concern.
How Does Data Minimization Relate to Retention?
Data minimization concerns limiting personal information processing to what is necessary for the specified purpose.
Storage limitation concerns how long information should be retained under applicable requirements.
For example, a researcher may reduce the amount of information submitted to AI by selecting relevant excerpts rather than complete transcripts.
The researcher should also consider whether those excerpts need to remain within the provider's systems after the analytical task is complete.
These are related but distinct questions.
Researchers should examine data minimization in AI-assisted analysis alongside retention and deletion requirements.
How Should Researchers Explain Retention in Participant Materials?
The explanation should distinguish the institution's research records from information retained by the AI service.
It should also identify verified retention periods or criteria where relevant and avoid unsupported deletion assurances.
Illustrative Participant Information
Explaining AI Provider Data Retention
"Selected portions of your interview transcript may be processed using an external generative AI service authorized for this study. The provider may retain submitted information and related processing records according to the conditions of the approved service agreement. The applicable retention period or criteria, including any relevant exceptions, will be described in the study's data privacy notice. These arrangements are separate from the university's retention of original research records. The research team will follow the approved procedures for managing and deleting information processed through the service."
This example is a template, not a substitute for actual retention information required by law or institutional policy.
Researchers should replace general wording with verified periods, criteria, and relevant exceptions before using the statement where those details are required.
The statement should not be used unless the described service authorization and data management procedures have actually been established.
Can AI Help Review a Provider's Retention Terms?
Generative AI can help organize and summarize verified contractual or policy text, but it should not be relied upon to invent or independently certify provider obligations.
Illustrative AI Prompt
Preparing a Research Data Retention Disclosure
"I am reviewing data retention conditions for an external generative AI service proposed for research. I will provide the applicable provider agreement, product configuration, data categories, institutional retention requirements, and participant information materials. Identify the verified retention periods or criteria for prompts, uploaded files, generated outputs, logs, and other relevant records. Distinguish user-interface deletion from underlying service deletion and identify any documented exceptions. Suggest clear participant disclosure wording without inventing retention periods, claiming immediate erasure, or assuming that disabling model training eliminates retention. Flag unresolved contractual or technical questions for institutional review."
The researcher should verify the analysis against the actual agreement and consult appropriate institutional personnel when necessary.
What If the Provider's Retention Policy Changes?
Provider terms and service configurations may change over time.
For example, a new retention condition may alter how long submitted research information remains within the service.
Researchers should determine whether the change affects the approved protocol, institutional authorization, or participant information.
Consequential changes may require additional review, revised privacy notices, or other measures under the applicable framework.
Researchers should not assume that an earlier retention assessment remains accurate indefinitely.
Where the provider offers contractual change notifications, the research institution should establish how relevant updates will be evaluated.
What If the Provider Cannot Explain Its Retention Conditions?
Researchers should not submit protected participant information when essential retention conditions remain unresolved and prevent the institution from establishing that the processing is appropriate.
For example, a researcher may be unable to determine whether uploaded transcripts are retained after deletion or whether the provider's permitted uses are consistent with the approved research purpose.
In such circumstances, the researcher should seek authoritative clarification before proceeding.
If adequate information or safeguards cannot be established, an authorized alternative may be necessary.
The ethical decision may be not to use the proposed AI service for the protected data.
Does Disclosure Alone Make Long-Term Retention Acceptable?
No. Informing participants that an AI provider may retain information does not independently justify indefinite or unnecessary retention.
Retention must still satisfy applicable purpose, necessity, proportionality, security, and authorization requirements.
For example, a researcher cannot automatically justify retaining identifiable interview transcripts indefinitely through an external provider merely by mentioning that possibility in the consent form.
The researcher should evaluate whether the retention is necessary and permitted, what safeguards apply, and whether less intrusive arrangements are available.
Transparency supports informed participation, but it does not replace substantive data governance.
