Deleting User Research Data From AI Notes & Transcripts

What deleting AI research data actually includes

Deleting user research data from AI notetaker transcripts and notes is rarely a one-button task. A participant’s information may appear in the recording, transcript, AI summary, speaker labels, action items, clips, exports, shared links, repository entries and copied quotations.

Treat each request as a cross-system review. Trace the original interview through every derivative artefact, including notes generated by an AI notetaker, files sent to colleagues and quotations copied into presentations or whiteboards. Removing a link is not the same as deleting a file, and archiving a file does not delete its data.

The right to erasure under UK GDPR is conditional, not automatic. Assess the request, lawful basis and any continuing obligations before promising deletion. Start with the ICO’s right to erasure guidance.

This is operational guidance, not legal advice. Put the process in your research operations guidance so it does not depend on one person remembering where an interview was used.

Triage the request before changing any records

Log the request when it arrives. Record its date, channel, wording, request ID and owner. An erasure request can be verbal or written, so do not require a particular form before assessing it.

Check identity only where there is genuine doubt, and collect no more information than is needed to resolve that doubt. Then establish:

• the study, sessions and dates in scope;
• the identifiable data and research artefacts that may exist;
• the lawful basis for processing;
• whether retention, legal claims or a research provision affects the request; and
• the people and suppliers responsible for relevant systems.

Set an internal deadline and an escalation route to the privacy lead or legal adviser. The ICO says organisations normally have one month to respond, although both the right and the appropriate response depend on the circumstances.

Our guide to UK GDPR compliance for research participants covers the wider research context.

Build a deletion map before you press delete

Create a row for every artefact before anyone removes anything. Otherwise, a deleted transcript can appear to complete a request while exports and copied quotations remain.

Use this deletion coverage ledger for each request:

Add rows for clips, downloaded files, email attachments, whiteboards, local project folders, shared documents and integrations. Take particular care with presentation quotations: removing a participant’s name does not necessarily make a detailed quote anonymous.

Keep three outcomes distinct. Deletion removes the identifiable artefact from the active system. Anonymisation irreversibly removes or changes identifying elements so the information no longer relates to an identifiable person. Archival storage keeps information under controls. Disabling a public link or moving a file into an archive is not deletion.

A user research plan template can help you identify systems and owners before fieldwork. Where interviews feed into synthesis, trace every item used for empathy mapping from interview data, including source quotations and linked recordings.

Run the removal workflow across tools, exports and backups

Use this sequence for each request, following the vendor’s current documentation and support process.

1. Pause sharing. Restrict new access to relevant recordings, transcripts and repository entries while you assess the request.
2. Remove or restrict the live source. Delete the recording. If deletion cannot yet be completed, apply the approved restriction and record the action.
3. Remove transcripts and AI outputs. Check transcripts, summaries, action items, clips, speaker labels and generated notes separately. Notion says that deleting a transcript does not remove summaries and notes in AI Meeting Notes blocks (Notion help).
4. Revoke shared access. Remove direct permissions, disable sharing links and find embedded copies in workspace pages.
5. Remove exports and copied quotations. Search shared drives, slide decks, spreadsheets, whiteboards, email attachments and project folders. Retain findings only after assessing whether they are genuinely anonymised.
6. Update repositories and integrations. Remove attachments, participant tags, linked insights and quotations. Check whether integrations copied the data into another system.
7. Notify recipients and processors. Where data has been disclosed, the ICO says organisations must generally contact recipients and tell them about the erasure. Use a vendor support route where you cannot complete the action yourself.
8. Record backup treatment. Identify the backup process, retention schedule and controls that prevent ordinary use. Record what remains and which schedule applies.
9. Verify each row. Capture evidence suited to the system: a deletion confirmation, ticket reference, audit-log entry, screenshot or vendor acknowledgement. Where appropriate, reopen links and search the repository.
10. Respond and close. Explain the outcome, recipient notification where relevant, backup treatment and any justified limitation. Close the ledger only when every row has an action and supporting evidence.

For example, a hypothetical researcher may delete a transcript, then find a generated summary in the workspace and two quotations in a slide deck. The request remains open until each item has an owner, action and verification record.

Use this workflow alongside AI notetaker consent and privacy in user research and assess deletion capability when deciding how to choose AI user research tools.

Confirm completion and prevent the next scramble

Once you have completed the assessment and actions, send the participant a concise response. State what you removed, which recipients you notified where relevant, how backups are handled and whether any justified limit applies. Keep no more request or identity evidence than is needed to manage and demonstrate the process.

Turn the ledger into a research data retention workflow:

• set a retention period for each artefact type;
• assign an owner to every research system;
• limit uncontrolled exports and personal-device downloads;
• test deletion procedures periodically; and
• include return and deletion checks in vendor offboarding.

The ICO says retention policies should allow early deletion where appropriate (storage limitation guidance). Before the next study, test the ledger with a synthetic participant record, including studies that use AI-moderated interviews.

Deletion workflow checklist

• Log the request ID, date, channel, owner and response deadline.
• Check identity proportionately and assess whether erasure applies.
• Inventory recordings, transcripts, AI notes, exports, quotations, links and integrations.
• Add every artefact to the deletion coverage ledger.
• Delete or restrict live sources and derived material.
• Revoke access links and remove copied material.
• Notify relevant recipients and processors.
• Record backup treatment and verification evidence.
• Send a clear participant response and record the closure date.
• Involve the privacy lead or legal adviser for contested, complex or high-risk requests.

Frequently asked questions

Does deleting an AI meeting transcript also delete the summary?

Not necessarily. Product behaviour varies. Notion’s documentation says summaries and notes can remain in AI Meeting Notes blocks after a transcript is deleted. Check every transcript, summary, action item, workspace page, export and integration separately.

Do we need to delete research data from backups?

Address backup systems as well as live systems. Record the relevant backup schedule and controls that prevent ordinary use, then explain the position clearly to the participant. Apply the ICO’s erasure guidance and your organisation’s privacy advice to the circumstances.

How long do we have to respond to a deletion request?

The ICO’s normal timeframe is one month. Identity checks, extensions and whether the right applies depend on the circumstances. Log the request promptly and escalate complex cases early.

Can we keep anonymised interview findings after a participant asks for deletion?

Only if the material is genuinely anonymised. A person may remain identifiable through their context, role, a combination of details or a verbatim quotation after their name is removed. Document the assessment and seek privacy or legal review if uncertain.

---

About Glasgow Research — Glasgow Research helps B2B SaaS teams turn customer and market research into product decisions. Work with us.