Most organisations are preparing for AI by consolidating and retaining more data. But the stronger strategy is arguably the opposite. One of the most valuable ways to prepare for enterprise AI this year is actually to dispose of data. This runs counter to a decade of data strategy built around consolidation and the assumption that more data automatically delivers better outcomes. But doing a bit of housekeeping is, in fact, a fast route to a more effective AI roll-out and more defensible General Data Protection Regulation (GDPR) position.
The estate your assistant will actually read
Data estates drift by accident rather than by design. Consider the SharePoint site a team set up in 2019 so an external contractor could reach a single document, which no one ever decommissioned. Or the four iterations of the expenses policy living on a server, three of them superseded, but none marked accordingly. Think of the shared drive left behind after a restructure that still contains a redundancy list, or an absence spreadsheet a former employee saved outside the HR system. The data had been protected simply because it was hard to find, although this was never an intentional security measure.
If you deploy an AI assistant that indexes everything on your systems, problems will inevitably arise at go-live. Personal data that should have been disposed of becomes trivially discoverable. When an AI assistant is presented with four versions of a policy and no indication of which is the most current, it is likely to answer from the wrong one with complete confidence.
Data minimisation, complimented by other key controls like role-based access control (RBAC), remain essential to ensure systems can only access information appropriate to a user’s role and authority.
This isn’t just an IT headache, but a direct tax on AI efficacy, as the cost of inaction will hit performance. Gartner predicts that organisations that prioritise semantics in AI-ready data will increase their GenAI model accuracy by up to 80% and reduce costs by up to 60% by 2027, which shows the value of investment.
Dispose before you index
Most programmes plan to tackle these issues after the pilot phase. After all, few leaders are willing to fund a data clear-out for a capability that has yet to prove its value. However, the economics point the other way. A file deleted before it’s indexed is gone with just one click, whereas deleting it afterwards means removing it from the source repository, search indexes, cached embeddings, and potentially a model that will need retraining.
Sequencing therefore matters more than just the tooling. To fix this, it’s important to start looking at the data repositories that have no clear owner, which carry the highest ratio of risk to value, and apply a straightforward test to everything else. For example, if a document were quoted verbatim in a response to an employee next week, would that be acceptable? If the answer is no, it does not belong in scope, regardless of its speculative future value.
Ownership is the control most programmes lack
It’s always worth remembering that data becomes risky at the point that it becomes nobody’s responsibility. An employee leaves, their files remain, and often no one can say with confidence what they contain, whether they’re still needed or whether they can be deleted. If you multiply that across a decade of turnover, it accounts for much of the exposure in most large organisations.
The answer is straightforward: every significant data set should have a named owner with the authority to make decisions about it. Not a committee or a lengthy approval process, but a person who can quickly decide whether an AI tool should have access to their part of the business. The most common cause of delay in AI approvals is not risk appetite, but the inability to establish who decides. Stripping away dead data and establishing this clear ownership is the exact mechanism that allows organisations to deploy AI further and faster than competitors bogged down in uncurated data swamps.
Purpose has to travel with the data
Purpose limitation is another area where these programmes often come unstuck. Information collected for one reason, such as payroll, can quietly become reference material for an assistant, simply because integration was easy. The safeguard is to attach purpose and lawful basis to the data itself, rather than burying them in a register that quickly falls out of date. Done properly, teams can see at a glance which datasets are suitable for a particular AI use case and which are not.
The instinct to consolidate everything into one repository deserves scrutiny. The European Data Protection Board’s draft guidelines on anonymisation, published in July, are clear that data stripped of identifiers remains personal data where it sits in a store that cannot be cleanly separated from records identifying individuals. Purpose-bound collections are easier to defend and easier to evaluate for accuracy.
Provenance, and the expiry of assurance
Responding properly to an access or erasure request also means knowing where each record originated and which downstream copies exist. Teams have long treated provenance as an engineering refinement that can be addressed later. But it is often the difference between a response measured in hours and one measured in months. The risk is that you tell someone their data has gone, confirm it to the individual, and leave the assistant answering from a copy nobody tracked.
Assurance ages the same way. An impact assessment signed in March describes a system that by September carries a different model version, new data sources and an agent performing actions nobody reviewed. It’s important to give assessments review dates and version references, so the evidence describes the up-to-date system in production.
Restraint as competitive advantage
There is time to do this deliberately. The Digital Omnibus has moved the AI Act’s obligations for higher risk standalone systems to December 2027, and the ICO has confirmed a statutory code of practice on AI and automated decision making for 2026 and 2027. That interval creates value only if it is spent on the estate rather than on documentation about it.
The organisations that get furthest with AI will not be those holding the most information. They will be those able to state, for anything they hold, what it is for, who owns it, where it came from and when it goes. For years, data minimisation has been treated as a brake on progress. In reality, it is now becoming one of the reasons some organisations are able to move faster than others.
Dhairya Mehta is a data expert at PA Consulting
