Question

A retail company deployed a Copilot Studio customer service agent that logs full conversation transcripts, including customer-provided personal details, to a Dataverse table for tuning purposes. Under GDPR, a customer submits a verified data subject deletion request. The architect must ensure the solution can honor such requests going forward while preserving the ability to tune the agent. Which design approach best satisfies the responsible AI privacy principle and compliance obligation?

Accepted Answer

Implement a data retention and deletion process that indexes stored transcripts by verifiable customer identifier and removes or de-identifies matching records on request, while retaining anonymized/aggregated tuning data

Answer

Disable all conversation logging so no personal data is ever stored, eliminating the need to respond to deletion requests

Answer

Rely on Dataverse's default backup retention to eventually overwrite the personal data within 90 days without a specific deletion workflow

Answer

Encrypt the transcripts at rest so that even if a deletion request is received, the data is considered protected and exempt from erasure