AI Data Lifecycle and Minimization

Short Answer

AI tools can create prompts, uploaded files, retrieved excerpts, outputs, logs, embeddings and backups in different locations. Texas Data Privacy and Security Act (TDPSA) Business and Commerce Code § 541.101 limits covered collection to data adequate, relevant and reasonably necessary for the disclosed purpose, and restricts incompatible secondary processing without consent. The biometric statute has a destruction rule and AI exceptions with their own conditions. Retention also has a competing legal-hold duty when relevant litigation is reasonably anticipated. A data lifecycle plan identifies the copy, its purpose, its permitted users and the event that starts deletion or preservation.

Which Laws Apply

• Texas AI-specific: Business and Commerce Code § 503.001(e) and (f) as amended by HB 149; Business and Commerce Code § 541.104(a)(2).
• Generally applicable Texas law: Texas Data Privacy and Security Act (TDPSA) Business and Commerce Code chapter 541 (purpose and minimization duties, data protection assessments); Business and Commerce Code § 503.001 (destruction deadline); Business and Commerce Code § 521.052 (reasonable security procedures); Texas spoliation law.
• Federal: Fed. R. Civ. P. 37(e); sector retention rules.

Map the Copies

For each approved AI use, list where information lives at each stage: the source system, the prompt, any files retrieved to answer it, the output, the vendor’s logs, any vector index or embedding store, any training or fine-tuning set, and backups. Ask the vendor which of these it keeps and for how long. Information that is deleted from the user interface may remain in logs or backups.

Limit What Goes In

The cheapest data to protect is data that never enters the system. Restrict connected sources to what the task needs, strip identifiers where they add nothing, and block categories the business never wants in an AI tool, such as biometric identifiers, health information outside a covered workflow or information held under third-party confidentiality agreements. The TDPSA’s purpose and minimization duties apply to controllers whether or not AI is involved.

Information Decays

Retained data can become wrong without changing. A field’s definition changes, a customer’s consent expires, a contract ends, a record’s authority is superseded. AI tools that retrieve old material can present it as current. A lifecycle plan should mark information with its source, date and permitted use, and retire it when those lapse, unless a legal duty requires keeping it.

Retention, Deletion and Holds

Set retention periods for prompts, outputs and logs that match business need and legal duty. The biometric statute requires destruction of biometric identifiers within a reasonable time and no later than one year after the purpose for collection expires, subject to exceptions (Business and Commerce Code § 503.001). When litigation is reasonably anticipated, preservation duties override routine deletion; in the consolidated OpenAI copyright litigation a 2025 order first required preservation and segregation of output logs that would otherwise have been deleted, but an October 9, 2025 order terminated the broad forward-looking duty effective September 26, 2025 while continuing preservation of previously segregated logs (with a geographic exception) and of logs from specified accounts, and leaving ordinary Rule 37(e) duties unchanged. Litigation hold notices should name AI systems expressly.

Training and Reuse

Before using business data to train or fine-tune a model, confirm that the original notice and consent cover that use. HB 149 exempted biometric identifiers used only to develop or train AI, unless the system identifies a specific person, but if those identifiers are later used for another commercial purpose, the statute’s possession and destruction rules apply again (Business and Commerce Code § 503.001(e), (f)).

Exit

When a vendor relationship ends, obtain return or deletion of data, including logs and any fine-tuning sets, and a written confirmation.

Illustrative Example (Hypothetical)

A Texas retailer connects an AI assistant to its customer service platform. The assistant retrieves five years of tickets, some containing payment disputes and health-related return reasons. A lifecycle plan would restrict retrieval to recent tickets, exclude health-related fields, set a 90-day retention period for assistant logs absent a hold, and require the vendor to delete logs on termination.

What Is Unsettled

Whether model weights trained on personal data are themselves personal data under the TDPSA; how deletion rights apply to data embedded in a trained model.