AI agents in businesses today read emails, fill in forms, communicate with customers, or process invoices — and in doing so, they almost always touch personal data. The question of AI agents and GDPR is therefore not a theoretical legal footnote, but a practical condition of deployment: who is responsible for the agent's decision, where the data is stored, and how the company can demonstrate that the processing is lawful. This article shows what to watch for when designing and running an AI agent so that it stays compliant with GDPR while still working effectively in practice.
Why AI agents and GDPR matters right now
The difference between conventional software and an AI agent is that the agent doesn't just store and display data — it also decides and acts: it sends a reply to a customer, approves a request, or assigns priority to a support ticket. GDPR does not distinguish between a decision made by a human and one made by a model; what matters is whether personal data is being processed, and whether that processing is controlled, transparent, and limited to what is strictly necessary. The combination of GDPR and artificial intelligence therefore raises several specific risk points that companies usually don't have to address to the same degree with conventional software: where data travels when a language model is called, how long it is retained in logs, and whether the agent might inadvertently make a decision with legal effects on a specific person.
If a company clarifies these questions before deployment, it avoids costly rework later on. For more on how AI agents work on a technical level, see What are AI agents and why they're changing the rules of software.
Legal basis for processing — the first step before deployment
Before an AI agent processes even a single piece of personal data, the company must have a clear legal basis under Article 6 of GDPR. In practice, this most often comes down to three situations:
| Agent deployment scenario | Typical legal basis |
|---|---|
| Agent answers customer questions about an order | Performance of a contract |
| Agent scores leads and qualifies prospects | Legitimate interest of the controller |
| Agent processes more sensitive data (e.g. health, HR matters) | Explicit consent of the data subject |
Legitimate interest requires a documented balancing test — the company must be able to show that its interest in automation does not override the rights of the data subject. For more sensitive categories of data (health, trade union membership, biometrics), legitimate interest generally cannot be used at all, and explicit consent or another special-category basis under Article 9 of GDPR is required.
Transparency: the data subject must know they're talking to an agent
Both GDPR and the separate AI Act place emphasis on informing individuals. If a customer is talking to an AI agent instead of a human, they should know it — just as they should know what data is being collected about them and for what purpose. In practice, this means:
- a clear indication that the communication is automated (chat, phone call, email),
- an up-to-date privacy policy that mentions AI-based processing,
- an easy way to escalate the conversation to a human.
This is directly linked to the degree of human oversight over the agent — a topic covered in more detail in Autonomous AI agents vs. agents with human oversight (human-in-the-loop), which explains when it makes sense to leave a decision fully to the agent and when it should be subject to human approval.
Automated decision-making and Article 22 of GDPR
The most sensitive point when deploying AI agents is Article 22 of GDPR, which restricts decision-making based solely on automated processing that has a legal or similarly significant effect on a person — for example, an automatic loan refusal, cancelling an order without human review, or automatically eliminating a candidate from a recruitment process.
This is precisely why the difference between a fully autonomous agent and an agent with human oversight is more than a technical choice — it's also a question of legal compliance. A similar logic applies when comparing approaches in AI agent vs. RPA: what's the difference and when to use which, where the autonomy of the process directly affects the level of risk.
Data and third parties: where the agent sends personal data
Most AI agents in a business run on a third-party language model (for example OpenAI, Anthropic, or Google). With every such call, the company is effectively handing data outside its own infrastructure, which from a GDPR perspective constitutes processing by a third party and requires:
- a signed Data Processing Agreement with the model provider,
- verifying where the data is physically processed (the EU, or a transfer to a third country with adequate safeguards),
- configuring the system so input data isn't used for further model training without consent.
Minimising data in prompts
A common mistake is that the agent sends the entire context of a customer record in the prompt to the language model — including data it doesn't need for the task at all. The data minimisation principle from Article 5 of GDPR applies here too: the agent should only receive the data it strictly needs to carry out a specific task, not the person's entire data profile.
Log retention and data subject rights
From a GDPR perspective, AI agent conversation logs are ordinary personal data, and the same rules apply to them as to any other record — a defined retention period, the ability to erase them, and the company's ability to locate and hand over data in response to an access request under Article 15. When deploying an agent, it's therefore worth settling the following in advance:
- how long conversation logs are retained and who has access to them,
- how the company will respond to a request to erase data processed by the agent,
- whether the logs contain data that shouldn't have been there in the first place (for example, a national ID number accidentally shared in the chat).
When a Data Protection Impact Assessment (DPIA) is required
If an AI agent processes personal data on a large scale, systematically monitors individuals, or makes decisions with legal effect, GDPR requires a Data Protection Impact Assessment (DPIA) before launch. The DPIA should describe the purpose of the processing, the categories of data, the risks to data subjects, and the measures taken to mitigate them. Methodology on DPIAs and automated decision-making is also published by the European Data Protection Board at edpb.europa.eu, a relevant source when preparing documentation.
Practical checklist before launching an AI agent
- Have we determined the legal basis for processing for every type of data the agent handles?
- Is a data processing agreement signed with the LLM provider, and do we know where the data is processed?
- Does the agent send only the minimum necessary data in the prompt, rather than the person's entire profile?
- Does the data subject know they're communicating with an automated system?
- Is there a point at which a human can review or change the agent's decision?
- Do we have a defined log retention period and a process for handling erasure requests?
This is an area where it pays to combine technical design with legal review already at the planning stage, not only after deployment. If you're integrating an AI agent into your business processes and need advice on setting up data processing, take a look at our artificial intelligence and automation solutions or get in touch via a no-obligation consultation.
Summary
Making an AI agent GDPR-compliant isn't a one-off check, but a set of decisions that need to be made at the design stage: what legal basis the processing relies on, how much data is actually sent to the model, how long logs are retained, and where in the process room is left for human intervention. Companies that resolve these questions before launch avoid costly rework later and reduce the risk of a data subject complaint — and can deploy the agent confident that it operates within the bounds of the law.