AI agents and GDPR: what regulators already expect from businesses

What changes when AI starts acting

A chat assistant answers what you type. An agent is given a goal (“reply to quote requests”, “reconcile this month’s invoices”) and works out the steps itself: it opens the mailbox, looks up the CRM, fills in a form and sends the reply. To do that, it needs accounts, API keys and permissions in your systems.

The CNIL and France’s Council for AI and Digital Affairs (CIANum) describe this as a change of scale. An agent can pull data from many connected sources, keep a memory between sessions and act on what it finds. The data passes through several services, and the person it belongs to loses track of what happens to it. CNIL/CIANum exploratory note, July 2026

The GDPR has no chapter on agents, and it doesn’t need one. The rules that already apply to any processing still hold: a defined purpose, only the data you need, appropriate security and an identified controller. Art. 5(1) and 24 What’s harder is meeting them when the system chooses its own route.

The Spanish case: an agent with a valid login

On 14 September 2026, the AEPD reported on its blog that it had received its first notification of a personal data breach caused by an attack carried out through an AI agent. The agent was built on a well-known language model. According to the notification, it searched generic files for vulnerabilities and managed to log in. Once inside the application, it went looking for new weaknesses on its own and ended up able to change personal data and access invoices.

The AEPD is careful to add three caveats. The information comes from the organisation that reported the breach and is still being analysed. Using a well-known AI model doesn’t mean the model or its provider was compromised. And a single notification isn’t a trend.

Even so, it draws practical lessons for anyone who processes personal data:

• Include attacks carried out or assisted by AI in the risk analysis for each processing activity, rather than filing them under “malware” or “unauthorised access”.
• Review your response times. A procedure designed for a human attacker may be too slow for an agent.
• Give more weight to identities and credentials. An agent with an over-permissioned account, API key or token moves quickly between services.
• Keep human oversight, but back it up with detection and containment tools that react in time.

Here the agent was the attacker. The same lessons apply to the agents you install yourself: an account with access to everything is just as dangerous when your own agent makes a mistake as when someone else’s agent gets hold of it.

What regulators are saying

CNIL: only the data needed, a human for critical actions, everything logged

The exploratory note from the CNIL and CIANum, published on 20 July 2026, isn’t formal guidance, but it’s specific. These are the points that matter if you’re about to put an agent to work:

• However many agents, models and third-party services are involved, you still need to be able to say who is the controller and who is a processor.
• The agent should process only the data strictly necessary for the task. If it pulls in emails, browsing history or files the task doesn’t need, that goes against data minimisation.
• Each agent should have its own memory, with no automatic access to the memory of other agents, and stored information should expire after a set time.
• Critical actions stay with a human. The note suggests ranking actions by risk (accessing data, deleting it, sending it outside the system), asking for approval before the most sensitive ones and having a button that stops the agent at any moment.
• You should be able to rebuild the whole process: which services the agent called, what it exchanged with them and in what order.
• People will find their rights harder to exercise. Deleting data in one place doesn’t remove it from every agent’s memory, and someone who wants their data erased may not know which agent collected it or who to ask.

ICO: consultation open until 20 November

On 8 October 2026 the ICO opened a six-week public call for evidence on agentic AI, aimed at both the people who build these systems and the organisations that use them. The questions cover security, transparency, accountability, automated decision-making, fairness and purpose limitation, and the lawfulness of processing. The answers will shape the ICO’s future guidance and the code of practice on AI and automated decision-making it’s preparing.

If you’re in the UK, this is your own regulator’s consultation: the UK GDPR and the Data Protection Act 2018 apply to you, not the EU GDPR, but the principles at stake are the same. Richard Nevinson, the ICO’s Director of Technology Regulation, summed up its position: “the fact AI agents act with autonomy is not an excuse for poor compliance”.

What businesses are seeing

Censuswide surveyed 3,221 senior managers for IBM, at companies with 1,000 or more employees in eight countries across Europe and the Middle East. Of those, 80% said an AI-related incident had reached the board or the executive team in the past year, but only 40% changed their AI governance policies afterwards. And while 35% already have AI agents in production, only 37% say their governance was designed to scale with them.

Before you connect an agent to your business data

Answer these questions in writing before the agent gets its first account. Those answers become the documentation that the Data Protection Commission (DPC), or the ICO in the UK, can ask you for.

What is it for, and who answers for it?

Write down the agent’s task in one sentence, along with the name of the person responsible for it. The purpose has to be set before the processing starts. If the agent finds a new use for the data, that use isn’t authorised just because the agent found it: the rule on compatibility with the original purpose applies. Art. 5(1)(b) and 6(4)

What data and systems can it reach?

Give the agent its own account, never an employee’s, with only the permissions the task needs. By default, you may only process the data necessary for each purpose, and that covers how much data you collect, how far the processing goes, how long you keep the data and who can access it. Art. 25(2) An agent that answers quote requests has no business reading the HR folder.

What can it do without asking?

Separate what the agent does on its own (reading, summarising, drafting) from what waits for approval (sending to customers, deleting, paying, sharing data with third parties). If the agent makes a decision with legal or similarly significant effects for a person, such as turning down a job application or a loan, the rules on automated decision-making apply, including the right to human intervention. Art. 22 The CNIL’s view is that this intervention must be real and able to change the final decision: clicking “approve” without looking doesn’t count.

Can you rebuild what it did?

Turn on logs that show which data the agent read, which actions it took, which services it called and when. Without them you can’t answer a subject access request, investigate a mistake or report a breach with the right facts. Logs also help you prove you took appropriate security measures. Art. 32

Do you need a DPIA?

Probably, if the agent handles customer or staff data in any volume. The European Data Protection Board (EDPB) treats the innovative use of new technological solutions as one of the criteria that point towards a data protection impact assessment (DPIA), and where two criteria are met, an assessment is normally required. Art. 35; Guidelines WP248 rev.01 Large-scale processing, data about vulnerable people and combining data sets are other criteria on the list, and an agent can easily meet more than one.

What does the supplier contract say?

The agent’s supplier processes data on your behalf, which makes it a processor, and you need a contract that covers everything Article 28 requires. Check three things: whether your data is used to train models, where it’s stored and which other services the agent calls. Each of those services is a sub-processor, and you have to authorise it. Art. 28(2) and (3)

Where is it recorded?

Add the processing to your record of processing activities, with the purpose, the categories of data, the recipients and the security measures. Art. 30 The record of processing kit has a ready-made sheet for it.

If the agent gets it wrong or is turned against you

An agent that sends data to the wrong customer, deletes records or exposes an employee’s file causes a personal data breach like any other. If there’s a risk to people, you have 72 hours from the moment you became aware of it to notify the DPC (in the UK, the ICO). Art. 33(1) If you don’t have the full picture yet, notify with what you have and fill in the rest later. Art. 33(4)

The difference with an agent is speed: it can take hundreds of actions in a minute. Your response plan should say how to switch it off, who revokes its credentials and where the logs are kept. The 72-hour guide and the data breach response kit already cover these cases. Just add the agent to your list of systems, with the step for stopping it.

Frequently asked questions

If the agent comes from a big supplier, isn’t it their responsibility?

No. If your business decides to use the agent, what for and on which data, you’re the controller. The supplier is a processor and answers for what the contract and Article 28 require of it.

Do the supplier’s terms of service give me a lawful basis?

No. The lawful basis is yours to establish, and it depends on the purpose: performance of a contract with the customer, legitimate interests, consent or another basis. The terms of service govern your relationship with the supplier, not the processing of your customers’ data. Art. 6(1)

Has the DPC published guidance on AI agents?

As of 29 October 2026, we haven’t found DPC guidance specifically on AI agents. Its AI Insights Report of 25 September 2026, on its supervision of AI products from 2021 to 2025, includes a short case study: two controllers planned to launch AI agents that capture screenshots of a virtual browser, and the DPC recommended more transparency, warnings tailored to the use of agents and clearer information on the risks. In the UK, the ICO is working towards its own guidance through the call for evidence described above. In the EU, the most complete guidance we have found is the AEPD’s guidance on agentic AI from February 2026, written for controllers and processors. The CNIL note and the AEPD recommendations covered above add to it.

Sources

• AEPD, Primera notificación de una brecha de datos personales causada por un ataque ejecutado mediante un agente de IA, 14 September 2026 (in Spanish)
• AEPD, Inteligencia artificial agéntica desde la perspectiva de protección de datos, February 2026 (PDF) (in Spanish)
• CNIL, IA agentique et données personnelles: note exploratoire CNIL/CIANum, 20 July 2026 and full text (PDF) (in French)
• ICO, Agentic AI call for evidence, 8 October to 20 November 2026
• ICO, news release of 8 October 2026 on AI agents
• IBM, press release of 15 October 2026 on the study “The New Realities of AI Governance”
• Data Protection Commission, Data Protection Commission publishes AI Insights Report, 25 September 2026 and full report (PDF)
• Regulation (EU) 2016/679 (GDPR), Art. 5, 6, 22, 24, 25, 28, 30, 32, 33 and 35 (EUR-Lex)
• Article 29 Working Party (endorsed by the EDPB), Guidelines WP248 rev.01 on data protection impact assessment

Updated: 29 October 2026. This article is general information and isn’t a substitute for legal advice on a specific case.