Agentic AI and Personal Data Protection: How to Maintain GDPR Compliance
Key Takeaways
The processing of personal data in connection with the use of AI agents is subject to the GDPR. However, the specific characteristics of agentic AI require adapting how these rules are applied.
In response to these developments, the CNIL and the French AI and Digital Council (Conseil de l’IA et du Numérique – CIANum) have published a paper on the application of the GDPR to agentic AI systems.
As the use of AI agents continues to grow, the issue of access to personal data and its protection is becoming increasingly important.
AI agents differ from conventional generative AI tools in their ability to make decisions autonomously, orchestrate complex actions, and interact with third-party services, with or without human approval. This autonomy enables new uses, but it also fundamentally changes the way personal data is processed, i.e., collected, used, stored, and transmitted.
The processing of personal data in connection with the use of AI agents is subject to the GDPR. However, the way these systems operate requires adapting how existing personal data protection rules are implemented. In response to these developments, the CNIL and the French AI and Digital Council (Conseil de l’IA et du Numérique – CIANum) have recently published a paper analyzing how the GDPR applies to agentic AI. (1)
The use of AI agents requires organizations to determine how to maintain GDPR compliance in an environment in which several agents, memory systems, and services may successively be involved in performing the same task. Three sets of measures relating to system compliance must be implemented: determining the data the agent may access, controlling the actions it may perform autonomously, and ensuring the traceability of the tasks performed by the agent.
1. Determine the Personal Data the AI Agent May Access
The first data protection risk stems from an AI agent’s ability to access multiple data sources and use them on its own initiative to perform a task.
An agent connected to email, a calendar, a CRM system, a document repository, or a business application may have access to a considerable amount of corporate data, including employees’ and customers’ personal data, as well as data relating to the company’s business activities. However, the fact that data is technically accessible does not mean that it is necessary for the processing operation.
1.1 Precisely Define the Scope of Data Access
The organization must retain control over its data by clearly defining the scope of access granted to the AI agent. Accordingly, before any deployment, it is strongly recommended to determine:
· the data sources that the agent may access;
· the categories of data required for each task;
· which agents may access which information; and
· the circumstances in which data may be transmitted to other agents or third-party services.
This preliminary analysis should make it possible to identify the processing operation or operations that will be carried out and, in particular, to ensure compliance with the GDPR principles of purpose limitation, lawfulness, and data minimization.
The objective is to prevent an agent from having, by default, broad access to environments containing far more information than is necessary. For example, an agent responsible for scheduling an appointment does not necessarily need access to an entire email account or document repository.
1.2 Identify Data Flows Between Agents and Third-Party Services
The difficulty does not arise solely at the point where data enters the system. In an agentic architecture, information may circulate between an “orchestrator” agent, several “specialized” agents, and various external services. (2) The organization must therefore identify data flows beyond the first agent visible to the user.
This requires, in particular, determining the types of data transmitted from one agent to another, which third-party services are used, whether those services retain the data, whether the data is transferred outside the European Union, and the legal basis on which these various processing operations rely.
1.3 Control Persistent Memory
Agentic systems use memory storage mechanisms that allow information to be retained from one process to another. Over time, this memory may accumulate a significant amount of information about the user and enable increasingly extensive hyper-personalization of the system.
It is recommended to determine which data may be stored in memory, how long it may be retained, for what purposes, whether the data may be reused in future tasks, and how it may be rectified or deleted.
It is also necessary to maintain consistency within an architecture involving several memory systems, by preventing inaccurate, outdated, or contradictory information from being retained in one part of the system after it has been corrected or deleted elsewhere.
2. Control the Actions the Agent May Perform Autonomously
The second measure to be implemented concerns the degree of autonomy granted to the system.
AI agents may be designed to perform very different tasks, with varying degrees of autonomy, ranging from merely accessing information to carrying out actions that may have substantial consequences for the user or third parties.
The data protection implications therefore vary directly depending on the nature of the operations the agent is authorized to perform, its degree of autonomy, and the data concerned.
2.1 Classify Actions According to Their Risk Level
Determining the degree of autonomy granted to an AI agent requires classifying the agent’s actions according to their level of risk, taking into account both the nature of the operation performed and the categories of data concerned.
Merely accessing information does not raise the same issues as modifying or deleting data, transmitting it to a third party, or carrying out an operation that may have significant consequences for an individual. The degree of autonomy granted to the system must therefore be adapted to the risks that these operations pose to data protection and individuals.
The most sensitive actions, particularly where they involve special categories of personal data under the GDPR, such as health data, or confidential information, should be subject to enhanced safeguards, such as genuine and effective human intervention before they are carried out.
2.2 Maintain Genuine and Effective Human Intervention
Where an action may have significant consequences for data subjects, merely having a human involved in the process is not sufficient. Human intervention must be genuine and effective. A person who merely systematically approves the agent’s recommendation without having the information necessary to assess it does not necessarily provide adequate oversight.
This issue is particularly important where the data processing falls within the scope of Article 22 of the GDPR, which concerns decisions based solely on automated processing that produce legal effects concerning a data subject or similarly significantly affect that data subject.
Organizations must therefore identify in advance the situations in which the agent’s autonomy must be restricted.
2.3 Provide a Mechanism for Interrupting Process Execution
Control over autonomy should not be exercised solely before a task is performed. It must also be possible to interrupt a process when unexpected system behavior occurs. An emergency stop mechanism, or “kill switch”, is intended to immediately interrupt the execution of an agentic process.
Real-time monitoring, detection, and filtering mechanisms may also be necessary to identify unusual system actions or unforeseen sequences of actions.
3. Ensure Traceability of the Tasks Performed by the Agent
The third measure to be implemented concerns the traceability of the tasks performed. An organization cannot demonstrate GDPR compliance if it is unable to reconstruct how a task performed by an agentic system was carried out. Traceability must therefore be regarded as a core component of governance.
3.1 Trace the Data, Agents, and Services Involved
For any given task, the organization should be able to identify not only the agents involved, but also the personal data used, the third-party services called upon, the exchanges that took place, and the order in which they occurred.
Traceability makes it possible to understand how the system operates. It is also an essential tool for responding to a data subject rights request, such as a request to exercise the right of access, rectification, or erasure, for investigating an incident, or for identifying the source of an error.
3.2 Use Logging as a Governance Tool
Logs should not be regarded solely as a technical tool for cybersecurity teams. They also contribute to compliance with the GDPR, particularly the accountability principle.
Sufficiently detailed logging of tasks can help demonstrate why certain data was used, what action was performed, pursuant to which instruction, using which services, and under what level of human oversight.
This documentation makes it possible to reconstruct the chain of responsibility where several parties are involved in the same process.
3.3 Clarify the Allocation of Roles Among the Various Parties Involved
Deploying an agentic AI system does not remove the need to identify the controller. The appropriate qualification will depend on the purposes and means of the processing and on how the processing is organized in practice.
The technical complexity of the architecture cannot result in a dilution of responsibility.
The organization using the system must therefore be able to precisely determine the roles of the various parties involved and define:
· who determines the purposes and means of the processing (i.e. the data controller);
· which parties act as processors;
· which data flows take place between them;
· which contractual obligations apply to them; and
· who is responsible for handling data subject rights requests or responding in the event of a personal data breach.
In summary, deploying AI agents does not require reinventing the GDPR. It does, however, require organizations to apply its principles to systems that are far more autonomous and interconnected.
In an agentic architecture, GDPR compliance cannot be considered solely at the level of the model or the individual agent. It must encompass the entire execution chain, from the collection of data through to the action performed and its logging.
* * * * * * * * * *
(1) “Agentic AI and Personal Data Protection: An Equation with Multiple Unknowns for Users” (“IA agentique et protection des données personnelles : équation àinconnues multiples pour les utilisateurs”), paper published by the CNIL and the French AI and Digital Council (Conseil de l’IA et du Numérique – CIANum) on July 20, 2026 (in French)
(2) The “orchestrator” agent is the main interface between the user and the system. “Specialized” agents can perform complex tasks. They are coordinated by the orchestrator agent. A “process” consists of processing requests. It retains the history of exchanges with the user, the instructions received, and all interactions with other agents and services.
Bénédicte DELEPORTE
Avocat
Deleporte Wentz Avocat
www.dwavocat.com
August 2026