Yes, treat it as one. A soft delete can be restored while the data still exists, but most deletions become permanent once purges run and backups expire, and some remove records the organisation must keep. An AI agent can find and propose deletions; a person approves anything permanent or anything under a retention duty.
When is a deletion actually reversible?
Deletion comes in stages. A soft delete marks a record as removed but keeps it, so it can be restored. A hard delete removes it from the live system, though it may survive in backups. A purge removes it from backups too. Only the first stage is reversible in any practical sense, and only for as long as the soft-deleted data is kept.
So the answer depends on the system and the timing. An agent that soft-deletes a duplicate contact in a CRM with a 30-day recycle bin has taken a reversible action, for 30 days. An agent that deletes files from storage with no versioning has taken an irreversible one immediately.
Many teams discover the difference only after the event. Before giving an agent any delete permission, find out which stage each delete reaches in each system it touches. The general definition is in what an irreversible action is.
Why can deleting data be as harmful as keeping it?
Deletion is often framed as the safe option: less data, less risk. Under GDPR Article 5, storage limitation means personal data should not be kept longer than needed. But deleting the wrong data carries its own harm.
Regulated firms must keep many records for set periods: transaction histories, customer due diligence evidence, complaint files, clinical records. Deleting them early can breach those duties and remove evidence a regulator or a court will later ask for. Deleting data under a legal hold is worse, because it can look like destruction of evidence.
And deletion destroys the means of checking it. If an agent deletes the wrong records, the record of what it deleted may be the only trace left.
What can the agent do, and what stays with a person?
| Task | The agent | Stays with a person |
|---|---|---|
| Finding data past its retention period | Identifies records and lists them with the rule that applies | Nothing at this stage |
| Checking for holds | Checks every record against legal holds, open complaints and investigations | Deciding on conflicts |
| Proposing deletion | Drafts the deletion list with reasons | Approving it |
| Soft deletes in systems with recovery | May run at depth 3 for routine cases within set limits | Exceptions |
| Hard deletes and purges | Never on its own | Approving and running them |
| Erasure requests from individuals | Finds the data, checks exemptions, drafts the response | Deciding what to erase and what to keep |
A worked example
Take a building society that receives a request from a former customer to erase their personal data. The agent searches the core banking system, the CRM, the document store and the complaints system.
It finds the customer's records in all four. It checks each against the society's retention schedule. Account transaction history and identity evidence fall within mandatory retention periods. Marketing preferences and an old savings enquiry do not. A complaint closed the previous month has a retention period that has not yet run.
The agent drafts a response that sets out what will be erased, what must be kept and why, with the rule for each. It proposes deleting the marketing data and the enquiry, and holds the list for the data protection officer. The officer approves, a person runs the deletion, and the agent records what was removed and when.
How do you stop an agent deleting what it shouldn't?
- No delete permission by default. Most agents never need it. Grant it per system, per record type, and only where recovery exists.
- Holds checked at the moment of action. Every proposed deletion is checked against legal holds and retention rules when it would run, not when the list was drafted.
- Deletion lists, not deletion calls. The agent produces a list; a separate, approved step executes it.
- A record of what was removed. Keep a minimal log of each deletion, its reason and its approver, without retaining the deleted content.
Our answer on how to stop an AI agent from deleting data goes further into enforcement, and how to require a person for every irreversible action covers the approval pattern. The underlying principle is set out in why autonomy in regulated industries is a question about reversal.
Questions people ask
Is archiving the same as deleting?
No. Archiving moves data to cheaper or less accessible storage but keeps it. It is reversible and usually lower risk, though access controls on the archive still matter.
Can an agent clean up duplicate records?
It can identify duplicates and propose merges. Merging customer records combines histories, which can be hard to separate later, so a person should approve merges in regulated systems.
What about deleting an agent's own working data?
Temporary data the agent created for its own task can usually be cleared automatically. Anything that forms part of the record of what it did must be kept.