Question

A consumer-facing company operates in a region where privacy regulations grant customers the 'right to be forgotten.' A customer has formally requested that all of their personal data be deleted, including any data used to train the company's machine learning models. The compliance team asks the ML team how to best respond to this request for data used in model training. What is the most appropriate action?

Accepted Answer

Remove the customer's records from the training datasets and retrain or fine-tune the affected models on the updated data, documenting the process for audit purposes

Answer

Delete only the customer's records from the production inference logs, since the trained model no longer stores individual records

Answer

Apply a Bedrock Guardrail to filter out the customer's name from all future model responses

Answer

Rotate the KMS key used to encrypt the training data bucket so the customer's data can no longer be decrypted