India’s data protection rules give every user the right to have their personal data erased, and full compliance is due by May 13, 2027. But AI models do not store information the way databases do, and there is still no reliable way to make a trained model forget. For Indian firms building AI for clients at home and abroad, this is fast becoming a procurement question rather than a legal one.
India now guarantees a right that sounds simple and turns out to be one of the hardest unsolved problems in computer science. You can ask a company to delete your personal data, and it has to comply. The Digital Personal Data Protection Rules, notified on November 13, 2025, put a clock on it. A company must erase your data once the purpose it was collected for is served, or once you withdraw consent. Large e-commerce platforms and social media intermediaries with more than two crore registered users, and online gaming platforms with more than fifty lakh, must clear out anyone who has not engaged for three years, after 48 hours of notice. Grievances must be closed within ninety days.
Full compliance is due by May 13, 2027, and the Data Protection Board is already operational, so complaints can be filed today. Failing to honour a rights request carries penalties of up to Rs 50 crore. A security lapse that leads to a breach can run to Rs 250 crore. For conventional systems this is routine work. You find the record and you delete it. But a growing share of Indian business now runs on AI models, and a model does not store information the way a database does. It absorbs it.
A database keeps records. A model keeps patterns
When a large language model is trained, it does not file away a copy of every document it reads. It adjusts millions of internal values until the patterns in that text are folded into the model itself. Usually the original data cannot be read back out. Not always, though. Researchers have shown repeatedly that models memorise fragments of their training data and will reproduce them word for word, including names, phone numbers and email addresses, sometimes when nobody asked. So the data is in there, smeared across the model’s internal wiring, with no single row to point at and remove. That is the mismatch. The law assumes personal data sits somewhere you can locate. A trained model puts it everywhere and nowhere at once.
Machine unlearning is not deletion
The field has a name for the attempted fix. Machine unlearning aims to make a model forget specific information without retraining it from scratch and without damaging everything else it knows. Serious work is going into it. The honest status is that nothing works reliably yet. A 2025 study presented at NeurIPS showed that even “exact” unlearning, the strictest version of the technique, can be undone.
By comparing the model before and after, the researchers roughly doubled their success rate at extracting the supposedly deleted data. Separate work has found that fine-tuning an unlearned model on a small and entirely innocuous sample can bring the forgotten material straight back, which suggests current methods obscure the output rather than remove the knowledge. Researchers describe an awkward three-way tradeoff. You want genuine forgetting, a model that still performs well afterwards, through one.
Build so you never need it
If the cure is unreliable, the answer is prevention, and it is an architecture decision taken long before the compliance team gets involved. The practical pattern is to keep personal data outside the model and let the model read from it only when it needs to. The sensitive information sits in an ordinary database, the kind you can query and delete. The model supplies the language and the reasoning around it. When someone asks to be forgotten, you delete the record and the model loses access cleanly. The capability stays. The personal data was never locked inside it. None of this is exotic. Retrieval-based architectures are already common practice for accuracy reasons, because they let a model work from current data instead of guessing from what it memorised months ago. The privacy benefit is sitting there unclaimed in most deployments.
Know what you fed it
The second half of the job is discipline about what enters training at all. Many companies cannot answer a basic question: what data was this model trained on? Without that record you cannot promise anyone their information has been removed, because you do not know whether it was ever there. Keeping a documented inventory of training data, stripping personal identifiers before training rather than after, and retraining on a defined schedule are unglamorous tasks. They are also the difference between honouring a deletion request and bluffing and a process cheap enough to run on demand. Getting all three at once has so far proved out of reach. Retraining a large model from scratch is the one approach that clearly works, and it can cost crores and take weeks. No business is going to do that for every deletion request.
A $246 billion question
For Indian firms this stops being theoretical quite soon, and the exposure runs in an uncomfortable direction. India’s tech exports are on track to cross $246 billion in FY26. The country hosts more than 2,100 global capability centres. Nasscom puts AI-specific revenue for Indian services firms at $10-12 billion this year. The businesses most affected are precisely the ones India has built its reputation on, handling other people’s customer data and building AI systems on top of it. A European or American buyer evaluating an Indian AI vendor will soon start asking a pointed question in procurement. If one of our customers demands deletion, can you show us their data is gone from your model? “We believe so” does not win contracts. A documented architecture that makes the answer obvious does. Provable deletion is heading the way SOC 2 and ISO 27001 went, from a differentiator to a basic requirement, and the firms treating it as an engineering problem now will be bidding against competitors still treating it as paperwork.
What to do before may 2027
Five things are worth starting this quarter. First, map where personal data actually sits across your AI systems, including anything already used in training or fine-tuning. Second, move personal data out of model weights and into retrievable stores wherever the use case allows. Third, keep a training data inventory that survives staff turnover. Fourth, run a deletion request end to end and find out whether you can actually prove the outcome. Fifth, write the deletion story down before a client asks for it, because the first draft should not be produced during a security review.
We built machines whose usefulness comes from remembering, then wrote laws giving people the right to be forgotten by them. The tension is real, and pretending otherwise helps nobody. But the way through is not a delete button that does not exist. It is more mundane. Keep people’s data where you can still reach it, know what you fed your models, and stop treating forgetting as something you can add on later. The right to be deleted is only as real as the architecture behind it.
*Shaurya Sengar is a US-based software engineering leader working at the intersection of AI systems and privacy engineering. Views expressed are personal.
