AI agents and personal data: what the GDPR means for agent work

AI agents read inboxes, summarise customer files, screen applications and update records. Much of that is personal data, and in the EU the General Data Protection Regulation (GDPR) applies to it whether a person or an agent does the processing. This page explains, in plain language, which parts of the GDPR matter most for digital collar work. It is an overview, not legal advice: for a specific case, read the current text and get qualified advice.

The short answer: the GDPR does not have special rules for AI agents, but its general rules bite hard on them. Give an agent only the personal data it needs, for a stated purpose. Do not let it make decisions with legal or similarly significant effects on people on its own unless an exception applies and safeguards, including human intervention, are in place. Assess high-risk uses before you start, choose vendors that give sufficient guarantees, and be able to show your organization complies.

The principles still apply

Article 5 of the GDPR requires personal data to be (GDPR, Article 5):

• processed lawfully, fairly and in a transparent manner;
• collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with them (purpose limitation);
• adequate, relevant and limited to what is necessary (data minimisation);
• accurate and, where necessary, kept up to date;
• kept in identifiable form no longer than necessary (storage limitation);
• processed with appropriate security (integrity and confidentiality).

The controller, usually the organization deciding why and how data is processed, must be able to demonstrate compliance with all of these (Article 5(2), accountability).

For agent work, three of these principles matter most in day-to-day practice:

• Minimisation: an agent that drafts replies to a customer does not need access to the whole customer database.
• Purpose limitation: data collected to handle support tickets should not quietly become training or profiling material for something else.
• Accuracy: an agent that writes wrong facts into a person's record creates an accuracy problem. Our guide to checking AI output matters here as much as anywhere.

Build it in from the start

Article 25 requires controllers, both when deciding how processing will work and during the processing itself, to implement appropriate technical and organisational measures, such as pseudonymisation, designed to put data protection principles like data minimisation into effect (GDPR, Article 25). For an agent, that means deciding what it can see and keep when you write its job, not after something goes wrong.

Decisions about people

Article 22(1) gives people the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them (GDPR, Article 22).

The right does not apply if the decision is necessary for entering into or performing a contract with the person, is authorised by EU or Member State law with suitable safeguards, or is based on the person's explicit consent (Article 22(2)). In the contract and consent cases, the controller must put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision (Article 22(3)). Further limits apply to special categories of data such as health data (Article 22(4)).

The key words are "solely" and "legal or similarly significant effects". An agent that drafts a recommendation that a person genuinely reviews is in a different position from an agent that rejects a loan application by itself. Our page on human in the loop and accountability covers how to set up a real review.

Telling people

When personal data is collected, Article 13 requires the controller to tell people, among other things, about the existence of automated decision-making covered by Article 22 and, at least in those cases, to give meaningful information about the logic involved and the significance and envisaged consequences for the person (GDPR, Article 13(2)(f)). Article 14 sets similar duties where data is not obtained from the person directly, and Article 15 gives people a right of access that covers the same information.

Assess high-risk uses first

Article 35 requires a data protection impact assessment (DPIA) before processing that, in particular using new technologies, is likely to result in a high risk to people's rights and freedoms (GDPR, Article 35). It is specifically required for, among other cases:

• a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based;
• large-scale processing of special categories of data, or of data on criminal convictions and offences.

The assessment must at least describe the processing and its purposes, assess its necessity and proportionality, assess the risks to people, and set out the measures to address them. National supervisory authorities publish lists of processing that needs one.

Choosing AI vendors

Most agents run on a model or platform supplied by another company. Where that company processes personal data on your behalf, Article 28 requires you to use only processors providing sufficient guarantees to implement appropriate technical and organisational measures, and the processor may not bring in another processor without your prior written authorisation (GDPR, Article 28). In practice, ask where the data goes, whether it is used to train the vendor's models, how long it is kept, and who else handles it.

GDPR and the AI Act together

The EU AI Act adds its own duties for some AI uses, such as informing workers before high-risk systems are used at work. It does not replace the GDPR: where an AI system processes personal data, both can apply. See our page on AI at work and workers' rights. Both laws are subject to ongoing guidance and proposed amendments, so check the current text before relying on any detail.

A checklist for agents that touch personal data

• State the purpose and the legal basis before the agent starts.
• Give it only the data it needs; restrict what it can store.
• Check whether any decision it makes is solely automated with significant effects.
• Put real human review and a way to contest decisions where needed.
• Update privacy notices to cover the processing.
• Run a DPIA for high-risk uses.
• Check vendor terms: data use, retention, sub-processors, location.
• Keep records that show how you comply.

The official text is published in the Official Journal of the EU on EUR-Lex. For easier reading by article, gdpr-info.eu offers an unofficial navigable copy.