Your product has an AI feature. A customer types a complaint or a loan query, and your backend sends that text to an LLM API. The provider often keeps a copy, and on 26 October 2026 Google changed one more default, this time for Gemini API data retention: new paid Gemini API projects now store Generate Content requests unless you switch it off.
Checked against each provider’s documentation on 2 Nov 2026. These settings change often, so recheck them.
Short answer: Since 26 Oct 2026, new paid Gemini API projects store Generate Content requests by default, for up to 55 days. OpenAI, Anthropic and Azure OpenAI also keep some prompts for set periods. India’s DPDP Act, whose main duties start on 13 May 2027, keeps your company responsible for what its AI provider does, so check each setting.
What changed in Gemini API data retention on 26 Oct 2026
The change covers the Generate Content API only, on the paid tier, and only projects created on or after 26 Oct 2026. Older projects keep their setting, which is off unless someone turned it on. The Interactions API already stored requests by default.
Logs are kept 55 days by default, and you can shorten that to 7, 14 or 28 days. Logs saved to a dataset never expire.
To stop storage, set store=false per request, or turn logging off in AI Studio’s Logs and Datasets settings.
Turning storage off still leaves copies
These project logs are separate from abuse monitoring, as Google’s logging policy says. Google’s zero data retention page lists what stays. Abuse-monitoring logs stay 55 days. Grounding with Google Search or Maps keeps data 30 days, with “no way to disable” it. File API uploads stay until you delete them or they expire.
For guaranteed zero retention, Google points to Vertex AI, now the Gemini Enterprise Agent Platform.
Other AI providers keep copies too
OpenAI keeps abuse-monitoring logs up to 30 days, Anthropic deletes inputs and outputs within 30 days, with exceptions, and Azure OpenAI keeps Responses 30 days. Removing the abuse-monitoring copy usually needs approval or a sales agreement.
Bluelupin is an OpenAI partner.
What DPDP expects from you: plan now for 13 May 2027
This is our plain reading of the official texts, written to help you plan. It isn’t legal advice. Check your own setup with a lawyer.
The DPDP Rules bring these duties into force on 13 May 2027. Our DPDP roadmap has the full timeline.
Section 8(1) of the Act keeps you responsible “irrespective of any agreement to the contrary” for processing your Data Processor does for you. Your LLM provider is likely your processor, so its defaults are yours.
Under Section 6(1), send the model only the fields it needs. Section 8(7) asks you to erase data once its purpose is served, so a dataset that never expires needs an owner and a deletion date.
Rule 8(3) asks you to keep “logs of the processing for a minimum period of one year.” Our reading: keep your own redacted processing logs for a year. Settle how long the provider keeps its copy with your lawyer. Our proof packs post covers what to keep as evidence.
What to do this week
- Mask or tokenize names, phones, emails, Aadhaar, PAN and account numbers before the prompt leaves your system. Our PII tokenization post explains how tokens work.
- Use a separate project for personal data, with storage off and a short window.
- Send fake personal data, then check what the provider’s logs stored.
- Ask your provider in writing what it keeps, for how long and why.
FAQs
Does the Gemini API store my prompts?
On the paid tier, yes. Gemini API data retention is on by default for Interactions, and for Generate Content in projects created on or after 26 Oct 2026, for 55 days unless you shorten it.
Does DPDP make me responsible for what my AI provider keeps?
Yes. Section 8(1) applies from 13 May 2027.
Is zero data retention enough for DPDP?
No. You still need purpose limits, minimum data, safeguards, a contract and your own logs.
If you’re building an AI feature
We can build in redaction, retention settings and contract checks from the start. Book a consultation, or write to sales@bluelupin.com. See what we build on our AI solutions page.