AI agents and the GDPR: what you need to arrange

A webshop deploys a customer-service agent. It reads orders, answers questions about returns and remembers what it saw before. A month later the privacy officer asks: on what legal basis does it do this, what can it actually see, and what do we tell a customer who asks what the agent holds about them?

Can an AI agent process personal data? Yes, under the same GDPR rules as any other processing. But an agent searches, combines, remembers and sends on its own, so you must arrange more up front.

When does the GDPR apply to an AI agent?

The GDPR applies as soon as an organisation processes personal data with an agent, wholly or partly by automated means (Article 2(1) GDPR). Processing is broad: consulting, storing and forwarding count too (Article 4(2) GDPR). An agent that reads an email with a name in it, summarises a file or keeps something in its memory therefore processes personal data, and its trail (prompts, logs, memory) often holds data about customers and employees. For you as controller, pseudonymised data remain personal data; only truly anonymous data fall outside the GDPR (recital 26 GDPR). For a recipient that cannot reasonably re-identify the person, that may be different, according to the Court of Justice (EDPS v SRB, C-413/23 P, 4 September 2025). The duties rest on the controller and processor (Article 4(7) and (8) GDPR), not on the agent. The AI Act comes on top as a separate layer; see our guide to AI agents and the law.

What legal basis and purpose does an agent need?

One agent usually carries out several processing operations, each with its own purpose and legal basis (Article 6(1) GDPR). The webshop's customer agent quickly does three: answering order questions (necessary for the contract), keeping conversations to detect abuse (possibly legitimate interests) and using conversations to improve the agent (a different purpose). The purpose must be specified, explicit and legitimate, and set in advance (Article 5(1)(b) GDPR). The Spanish authority AEPD notes that using an agent is not a purpose in itself, and if no processing is added you need no new legal basis.

The risk is that the purpose drifts: the European Data Protection Supervisor (EDPS) warns that an agent, in pursuing its goal, may itself determine new uses, and so new purposes, for personal data. Define the purpose per task ("answering questions about orders", not "helping the customer"), test every new use for compatibility (Article 6(4) GDPR) and enforce the boundary in software, not only in the instruction to the model.

What data may an agent see?

Data minimisation (Article 5(1)(c) GDPR) and data protection by default (Article 25(2) GDPR) limit what an agent sees, how long it keeps it and who can reach it. With agents it comes down to access: the UK regulator ICO gives as an example of poorly implemented agents that they are connected to databases they do not need.

• Give the agent only the permissions and tools the task requires, not those of an employee or administrator.
• Define per processing operation which sources the agent may consult (need-to-know, says the AEPD) and minimise per action.
• Limit the task: the Dutch data protection authority (Autoriteit Persoonsgegevens, AP) calls one specific task per agent an important good practice (RAN 6, p. 15).

Who is the controller and who is the processor?

An agent chain involves more than two parties: your organisation, the vendor, the language model provider and every tool or source the agent calls. The European Data Protection Board (EDPB) looks at what they actually do, not at the label in the contract (Guidelines 07/2020, para 12). Work it out per link:

• You are as a rule the controller; a vendor processing data on your behalf is a processor. That requires a processor agreement with the content of Article 28(3) GDPR, including a description of the processing (subject matter, duration, nature and purpose, types of data and data subjects), processing only on your documented instructions (also on transfers), confidentiality, security, assistance with rights, breaches and DPIAs, deletion or return at the end, and cooperation with audits. The language model is often a sub-processor: that requires your prior written authorisation, specific or general with a right to object to changes, and the vendor imposes the same obligations on the sub-processor (Article 28(2) and Article 28(4) GDPR).
• If the vendor also uses your data for its own purposes, such as training, it determines purposes and means itself and is the controller for that processing (Article 4(7) GDPR). If you allow this, you need your own legal basis to hand the data over for that purpose; if it does so without your instructions, it infringes the GDPR and is considered a controller (Article 28(10) GDPR; EDPB, para 81). Simpler: exclude training in the contract.
• If you and the vendor jointly determine purposes and means, also through converging decisions that complement each other (EDPB), you are joint controllers under Article 26 GDPR: make an arrangement between you; data subjects can turn to either of you.
• For tools and sources the AEPD looks at what flows: a service that processes data as part of your processing is a processor; a source or recipient outside your processing is a controller in its own right.

Map the data flows and note each link's role. The contract is covered in our article on buying an AI agent.

Is a DPIA required for an AI agent?

Not automatically, but often. Article 35(1) GDPR requires a DPIA before processing that, in particular when using new technologies, is likely to result in a high risk. New technology alone is not an automatic trigger; according to the AEPD it depends on the processing in which the agent is used. Test that processing with two tools:

• The nine criteria (risk signals) of WP248 rev.01, the European DPIA guidelines: as a rule a DPIA is needed when two are met, sometimes already when one is. An agent with broad access quickly meets two: highly personal data (WP248 mentions emails), combining sources beyond data subjects' reasonable expectations, employees as data subjects, innovative technology.
• The AP's list of 17 types of processing that require a DPIA (paragraph 4; Government Gazette 2019, 64418). Agents are not on it as such, but processing they can carry out is, usually if large scale or systematic: profiling, employee monitoring (such as email), communications data, fraud detection. The list is not exhaustive.

Review again when the risk changes, for instance through a new tool, source or model (paragraph 11). See when a DPIA is required for AI systems or start with the case check.

Does Article 22 GDPR apply to an agent?

Article 22 GDPR applies only to a decision based solely on automated processing that has legal or similarly significant effects, such as rejecting a claim or a candidate; most agent actions are not such decisions. Watch scores and rankings, though: according to the Court of Justice, a score is itself such a decision if whoever decides gives it a determining role (SCHUFA, C-634/21, 7 December 2023). The safeguards in paragraph 3 (human intervention, expressing a point of view, contesting the decision) apply only under the contract and explicit-consent exceptions (paragraph 2, points (a) and (c)); where the basis is law, the law itself must provide safeguards. See Article 22 GDPR and AI agents.

What do you tell data subjects, and how do they exercise their rights?

Data subjects must know what an agent uses their data for, who receives it, where it goes and how long it is kept. Article 13 GDPR applies to data you collect from the data subject, Article 14 GDPR to data you obtain elsewhere, which is often the case with agents. If the agent uses data obtained elsewhere to communicate with the person, you give the information at the latest at the first contact (Article 14(3)(b) GDPR).

The rights in Articles 15 to 21 GDPR also apply when an agent processes the data, each with its own conditions and exceptions. You answer without undue delay and at the latest within one month, extendable by two months for complex or numerous requests if you say so within that month (Article 12(3) GDPR). The EDPS expects that exercising them will be "very difficult" with agents, because they remember, build profiles and share information. Design for it: memory and logs that you can search, restrict and erase per person, memory separated per processing operation and case (AEPD), and a procedure that also reaches your processors.

How do you secure an AI agent?

Article 32 GDPR requires security appropriate to the risk, Article 25 GDPR data protection by design. A core risk with agents is the dangerous triangle: access to private data, exposure to untrusted content and the ability to communicate externally (Simon Willison: the "lethal trifecta", 16 June 2025). A language model cannot reliably tell where an instruction comes from, so a hidden instruction in an email can make the agent send data out. According to the UK NCSC, it is very possible that such attacks may never be totally mitigated (8 December 2025). Never give an agent all three at once, or have a human approve every outgoing message. The AEPD is stricter: an agent that processes untrusted input, has unrestricted access to sensitive data and then acts automatically, including in its memory or internal systems, should not be allowed (its "Rule of 2").

Further measures: minimal permissions, short-lived keys, human approval before irreversible steps, logs the agent cannot change, a tested emergency stop and regular testing (Article 32(1)(d) GDPR). See security risks of AI agents and the OWASP list.

When is an agent's mistake a personal data breach?

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12) GDPR). It does not even take an attacker: an agent that emails a file to the wrong recipient or deletes a database may cause a breach just as much as an agent that sends customer data away after a hidden instruction. Then:

• Notify the supervisory authority (in the Netherlands the AP) without undue delay and, where feasible, within 72 hours of becoming aware (Article 33(1) GDPR), unless a risk to data subjects is unlikely.
• Inform data subjects where the breach is likely to result in a high risk (Article 34 GDPR).
• Document every breach, including those you do not notify (Article 33(5) GDPR). Your processor must tell you without undue delay (Article 33(2) GDPR).

Without logs of tool calls you cannot tell what went to whom; appoint in advance who can stop the agent. If your organisation is an essential or important entity under the Dutch Cybersecurity Act, the same event may also be a significant incident with its own reporting steps: see AI agents and the Dutch Cybersecurity Act (NIS2).

May an agent send personal data to a model outside the EEA?

Yes, if there is a valid transfer route. Sending personal data to a model outside the EEA is as a rule a transfer with its own rules (Chapter V; Article 44 GDPR). The EDPB (Guidelines 05/2021) sees a transfer where a sender subject to the GDPR makes data available to another controller or processor in a third country. Remote access from a third country (even only viewing during support) and storage in a cloud outside the EEA count too; so check where support and sub-processors are.

A transfer can rest on an adequacy decision under Article 45 GDPR or on appropriate safeguards under Article 46 GDPR, such as standard contractual clauses; there, Schrems II (C-311/18) requires you to verify whether the law of the recipient country offers sufficient protection. For the US, the adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework (DPF; Implementing Decision (EU) 2023/1795) covers organisations on the DPF list. The General Court dismissed an action for annulment on 3 September 2025 (T-553/23); the appeal (C-703/25 P) was still pending on 5 November 2026. Check that the vendor is on the list (HR data must be expressly covered by the certification) and keep an alternative ready.

How long may an agent remember personal data?

An agent may not keep personal data longer than necessary for the purpose (Article 5(1)(e) GDPR). Agents often have memory that persists across tasks, even after the goal is reached (EDPS), and that memory is a database of personal data. Measures the AEPD names: a fixed retention period per type of data and per component (memory, logs, model provider), switching off persistent memory where it is not needed, and a policy at the model provider of not retaining prompt content (no-log or zero data retention). Logs remain necessary for security and for documenting a breach: choose a purpose and a period for each log.

Checklist: what you need to arrange

Record the result in your agent register. The articles apply as they stand; the Commission's digital omnibus proposal, which among other things amends the GDPR (COM(2025) 837), is not yet adopted (5 November 2026). It is not the Digital Omnibus on AI, which has been in force since 27 July 2026.

Back to the webshop: with a purpose per task, limited access and a memory you can search and erase per person, the privacy officer has all three answers. If you want someone to look over your agent design, from purpose to DPIA, you can hire Zahed Ashkara as a legal adviser for AI and privacy. The Agent-check gives a first picture beforehand.