Is an Embedding Personal Data? An Answer for SIs When the Client Asks
Embeddings are more than numbers. Learn why vector databases should be treated as personal data, and five things an SI should prepare before a security review.
The short answer: if the source text contains personal data, treat its embedding as personal data too. A vector is just numbers, but the original text can be reconstructed from an embedding, and vector databases usually store the original text chunk right next to the vector.
This question comes up when the security team at a bank, a state-owned enterprise, or a government agency reviews a RAG project. This article helps system integrators (SIs) answer it with evidence rather than assumptions.
Why is "just numbers" not a sufficient answer?
There are three reasons. Indonesia's Personal Data Protection Law (UU PDP) also counts data that can identify a person when combined with other information. Research has shown that text can be recovered from embeddings. And in practice, vector databases almost always store the text chunk and metadata alongside the vector. An "it's just numbers" argument is therefore hard to defend in front of an auditor.
- The legal definition. Article 1, point 1 of Law No. 27 of 2022 defines personal data as data about an identified or identifiable individual, on its own or combined with other information. An embedding that can be linked back to a customer document falls within that scope.
- Inversion research. Morris et al. (2023) recovered 92% of 32-token inputs exactly from their embeddings, including most full names in a set of clinical notes. OWASP lists embedding inversion among the LLM08:2025 risks.
- What the index holds. A single record in a vector database typically contains the vector, the text chunk, the file name, and a customer ID as filtering metadata. Only one column is truly "just numbers".
What should an SI prepare before a security review?
An SI should have answers and evidence ready for the five questions below. The one missed most often is where the embedding model runs. If embeddings are generated through an API abroad, the raw text has already left Indonesia before it becomes a vector, even if the vector database sits in Jakarta.
| Client security team's question | What the SI needs to answer | Evidence to prepare |
|---|---|---|
| Where does the embedding model run? | The processing location of embeddings, not only the storage location | Architecture diagram and sub-processor list |
| What is stored in the index? | Vectors, text chunks, metadata, and which fields contain personal data | Index schema |
| Who can query the index? | Access control per role and per tenant | Access policy and retrieval logs |
| What if a data subject asks for deletion? | Source documents, chunks, vectors, and caches are all deleted | A deletion procedure that has been tested |
| Does any data leave Indonesia? | Every API call, including embedding, reranker, and logging | Endpoint configuration and a list of third-party services |
Deletion requests are not a theoretical scenario. Article 8 of the PDP Law gives data subjects the right to delete and destroy data about themselves, and that right extends to copies inside the index.
Where IONext fits
IONext provides GPUs and managed inference hosted in Jakarta, operated by PT Data Awan Nusantara and certified to ISO/IEC 27001:2022 by TÜV NORD. SIs can run open-weight embedding models, a vector database, and an LLM on IONext infrastructure in Indonesia, with billing in rupiah. The boundary is clear: the index schema, application-level access control, and the deletion procedure remain part of the SI's design. Decisions about the data stay with the client as the personal data controller.
The full architecture is in a RAG architecture that keeps data in Indonesia. Responsibilities between the client, the SI, and the infrastructure provider are covered in how roles are split in AI projects. Certification details are on the IONext Trust page, and GPU specifications are on the IONext GPU page.
Preparing a RAG project for a client in a regulated sector? Discuss a co-sell pattern through the IONext Partner Program, or start trying ORBIT and IONA through self-service sign-up.
Sources
- Law No. 27 of 2022 on Personal Data Protection (JDIH Kemenkeu) (in Indonesian), accessed October 2026
- Morris, Kuleshov, Shmatikov, Rush. Text Embeddings Reveal (Almost) As Much As Text, arXiv:2310.06816 (2023)
- OWASP GenAI Security Project, LLM08:2025 Vector and Embedding Weaknesses, accessed October 2026
This article is general information, not legal advice. For decisions on a specific project, consult legal counsel.
IONext is sovereign AI infrastructure hosted in Indonesia, operated by PT Data Awan Nusantara in Jakarta. IONext provides GPU as a Service, managed inference through an OpenAI-compatible API, and open-weight model hosting, certified to ISO/IEC 27001:2022 by TÜV NORD.