The AI Act gets the headlines, but for most AI agents GDPR is the law that applies first and bites hardest. An agent that reads claim emails, customer chats or contracts processes personal data from its first run, whatever its AI Act risk class.
Data protection officers tend to ask the same seven questions about an agent. Here they are, with the article each one comes from and what a good answer looks like. We read the articles on 9 November 2026.
1. Who is the controller, and who is the processor?
The company that decides why and how personal data is used is the controller. A vendor that builds and runs the agent on its behalf is usually a processor. That split decides who answers to the people whose data it is, and it should be settled before anything else.
A good answer is one sentence in the contract: “For this agent, the client is the controller and the vendor is its processor.” If the vendor also uses the data for purposes of its own, such as training its models, it becomes a controller for that use, and you should ask why.
2. Is there a data processing agreement?
Article 28(3) lists what the contract with a processor must contain: the subject matter and duration, the nature and purpose of the processing, the types of personal data and categories of people, and the controller’s rights. It also binds the processor to act only on “documented instructions from the controller”, to keep the data confidential, to secure it (Article 32), to help with data subject requests and impact assessments, to delete or return the data at the end, and to allow audits.
A good answer is a signed DPA before the first real file reaches the agent, not after the pilot.
3. Which sub-processors are involved, and where?
An agent has more moving parts than most software: the hosting provider, often a model gateway, and the model provider itself. Under Article 28(2) a processor needs the controller’s “prior specific or general written authorisation” to engage another processor, and must inform the controller of changes so it can object. Under Article 28(4) the first processor “shall remain fully liable” for the ones it engages.
A good answer is a list, with each sub-processor’s role and location, plus the model provider and region for this particular agent. Be wary of any answer that names the hosting but not the model.
4. Does personal data leave the EU?
Article 44 allows transfers outside the EU only under the conditions of Chapter V, so that the level of protection “is not undermined”. For an agent, the place to look is the model call. The platform can be hosted in Germany while the model runs elsewhere.
A good answer names the model route and region per agent, and the legal basis for any transfer. An even better one offers an EU-region route and writes it into the DPA. A vague “your data stays in Europe” is a weak answer unless the contract makes it true for the model step too.
5. Does the agent see only what it needs?
Article 5(1)(c) requires data to be “adequate, relevant and limited to what is necessary”. Article 25 asks for data protection by design and by default, with only the data “necessary for each specific purpose” processed. For agents, this is concrete:
- connect only the systems the task needs;
- keep bank, identity and health data out of what the model sees unless the task needs them, by leaving them out of the data path or by masking them;
- keep test sets anonymised where possible.
A good answer shows, on a real example and before go-live, exactly what reaches the model. Ours is honest about its limit: our platform does not mask personal data before the model today, so we design the data path to leave out what the task doesn’t need. Health data brings its own rules under Article 9; our page on AI agents for healthcare covers them.
6. How long is the data kept, and can it be erased?
Article 5(1)(e) limits storage to “no longer than is necessary”. The AI Act pulls in the other direction for high-risk systems: deployers keep logs for at least six months (AI Act Article 26(6)). The two fit together if retention is set per agent and written down: long enough for oversight and the law, no longer.
Erasure under Article 17 must happen “without undue delay” when one of its grounds applies. For an agent, that means the conversations, the run records, the knowledge index and any stored credentials, plus a way to export what the controller must keep first.
A good answer gives a retention period per type of data and shows how erasure is done.
7. Does anyone decide, or does the agent?
Article 22 gives people the right not to be subject to “a decision based solely on automated processing, including profiling”, where it has legal or similarly significant effects. The exceptions (contract, law, explicit consent) still require safeguards, including “the right to obtain human intervention”.
A good answer is an agent that prepares and a person who decides: payouts, refusals, anything with a real effect. We wrote about how to design that step so it is more than a rubber stamp.
And the DPIA
Where processing is “likely to result in a high risk to the rights and freedoms of natural persons”, Article 35 requires a data protection impact assessment before it starts. Many agents in finance, insurance, health and HR will qualify. The vendor cannot do it for you, but it should hand you the inputs: the data path, the categories of data, the safeguards and the test results.
A one-page answer
We give every agent a one-page data path: what enters, where it is processed, which sub-processors and model region are involved, how long each piece is kept, and where a person decides. You can see ours on the trust page. It is the document we would want to receive if we were the DPO, and it is part of every AI Act and GDPR readiness review we do.
Questions
Do we need a DPIA for an AI agent?
Where processing is likely to result in a high risk to people, Article 35 requires one before processing starts. Many agents that handle customer, health or financial data will need one. The vendor should supply the data path, sub-processors and model route as inputs.
Can an AI agent process health data?
Only with one of the conditions in Article 9(2), such as medical care under professional secrecy, plus a DPIA and the narrowest data path. Leave out any health data the task does not need.
Is the AI vendor a controller or a processor?
Usually a processor, when it builds and runs the agent on your behalf. If it also uses your data for its own purposes, such as training its models, it becomes a controller for that use.
Sources
- gdpr-info.eugdpr-info.eu/art-5-gdpr/
- gdpr-info.eugdpr-info.eu/art-9-gdpr/
- gdpr-info.eugdpr-info.eu/art-17-gdpr/
- gdpr-info.eugdpr-info.eu/art-22-gdpr/
- gdpr-info.eugdpr-info.eu/art-25-gdpr/
- gdpr-info.eugdpr-info.eu/art-28-gdpr/
- gdpr-info.eugdpr-info.eu/art-32-gdpr/
- gdpr-info.eugdpr-info.eu/art-35-gdpr/
- gdpr-info.eugdpr-info.eu/art-44-gdpr/
- artificialintelligenceact.euartificialintelligenceact.eu/article/26/
Read on or before 12 November 2026. Not legal advice: your counsel and data protection officer decide.