A European retailer's support assistant stores conversation transcripts, writes full prompts to application logs, and indexes resolved tickets into a vector store used for retrieval. A customer submits a GDPR erasure request. Which two steps are needed to handle such requests properly? Select two.

Answer: B and C — Keep source-record metadata on indexed chunks so the customer's ticket content can be found and removed or re-embedded / Apply erasure and enforced retention limits to transcripts and logs that contain the customer's personal data

Erasure has to reach every copy, including derived stores. The vector index needs metadata linking chunks to source records (b), and transcripts and logs need erasure and retention enforcement (c). (a) alone leaves copies in the index, logs and transcripts. (d) hides the data in outputs but doesn't erase it, and it's prompt-only.