Prefer to listen? Click play for AI narration

A chatbot answers questions. An AI agent gets things done. It reads your inbox, searches the web, opens files, updates a CRM record, books a meeting, sends an email or makes a purchase, often in a chain of steps no human signs off one by one. Every one of those steps can involve personal data.

Privacy regulators have noticed. On 8 October 2026 the UK's Information Commissioner's Office (ICO) opened a call for evidence on agentic AI and confirmed enquiries into recent agent testing at several frontier labs. In July, France's CNIL published an exploratory note on agentic AI together with the French AI and Digital Council. Spain's AEPD issued its own guidance in February. Their message is consistent, and the ICO put it in one line: “the fact AI agents act with autonomy is not an excuse for poor compliance.” This article is for general information only and is not legal advice.

Why agents are on regulators' radar now

What makes agents different

Agents don't break the GDPR's logic, but they stretch it. Regulators point to four features.

The six questions regulators are asking

The ICO's call for evidence is built around six themes. The CNIL and AEPD cover the same ground, so together they work as a practical map.

1. Security: is the autonomy deliberate?

The ICO expects the level of autonomy given to an agent to be a deliberate design choice, backed by guardrails, permissions and approval thresholds proportionate to what the agent can do with personal data. Emerging measures it cites include least-privilege access, limits on tool use and human approval for high-risk actions. It also suggests registering each agent to a named owner, with a set purpose and set of permissions. The AEPD adds allow-lists of external services and “circuit breakers” that automatically halt an agent when they detect anomalous activity.

2. Transparency: is a notice at the start enough?

Because an agent's processing can change mid-task, the ICO questions whether a general explanation before a workflow begins satisfies transparency duties. It accepts that prompts, notifications and approval steps along the way add “friction”, but suggests they may be necessary. It also points out that if an agent stores or reads information on a person's device, the UK's electronic communications rules (PECR) may require clear information and, in some cases, consent. In the EU, Article 5(3) of the ePrivacy Directive (2002/58/EC) sets a similar rule for storing or accessing information on a user's device.

3. Accountability: who is the controller?

Agentic supply chains involve model providers, agent builders, tool vendors and deployers. The ICO says it has seen developers claim to be controllers only for development, maintenance and security, pushing responsibility downstream. Its answer is that the concept of controller should be interpreted broadly, and that whoever decides protocols, permissions and access controls may be determining the means of processing, and so may be a controller. The AEPD makes a related point: each third-party tool an agent calls can bring in new processors, independent controllers, joint controllership, international transfers and new contractual or information duties.

4. Automated decisions: look at the whole workflow

Under Article 22 GDPR, people have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. The ICO says organisations must assess this across the entire agentic workflow, not decision by decision: human input at one point in a chain of machine decisions is not necessarily meaningful. Reviewers should have authority to change the outcome and enough training to understand the system's logic, outputs, limitations and risks. The CNIL makes the same point by citing the EU Court of Justice's SCHUFA judgment (C-634/21): human intervention at the output stage isn't automatically sufficient; it has to be real and effective.

5. Purpose limitation: new uses need justification

Agents may take intermediate steps nobody asked for and reuse data from one task in another. The ICO is clear that an agent's ability to spot a new use for personal data doesn't make that use compatible with the original purpose. It also warns that calling product development “research” won't necessarily bring it within the scientific research provisions; processing solely for internal, commercial product development is unlikely to qualify.

6. Lawful basis: one click doesn't cover everything

According to the ICO, neither the terms of service nor a user's instruction to an agent provides a lawful basis for all the processing that follows. Contract as a basis covers only what is objectively necessary to deliver the service the user asked for, and different stages of a workflow may need different bases. Legitimate interests may be available, for example for training orchestrator models, but only with a documented legitimate interests assessment.

Data subject rights in a world of agents

Rights requests are where agents cause the most practical pain. The CNIL notes that a person may struggle to find out which agent collected their data, where it was stored, whether it was passed on and which controller to contact. That makes rectification and erasure hard to carry out completely.

The AEPD's answer is granular traceability. To respond to a request for access, rectification, erasure, restriction, objection or portability, an organisation must be able to locate every relevant element, including prompts and intermediate outputs when they contain personal data. Its recommended memory controls point the same way: separate memory by processing operation, case or user; keep the organisation's memory apart from the user's; set strict retention periods; and clean persistent memory regularly. The CNIL adds memory partitioned by agent and by process, with size limits and automatic expiry.

Where the AI Act fits

The AI Act (Regulation (EU) 2024/1689) applies to agentic systems like any other AI system. One obligation is already live: since 2 August 2026, Article 50(1) requires providers to design AI systems that interact directly with people so that those people are told they are dealing with AI, unless that is obvious. According to the Lithuanian data protection service Duomenų apsaugos tarnyba, the Digital Omnibus on AI (Regulation (EU) 2026/1744) did not change that provision. If your agent writes to customers in a human-sounding voice, the disclosure question applies. See our guide to AI Act Article 50.

More is on the way. According to the CNIL note, the EDPB and the European Commission are preparing guidelines on how the GDPR and the AI Act interact, expected by the end of 2026. The CNIL has also suggested that the EDPB follow its work on AI models and web scraping with recommendations specific to agentic AI.

Practical checklist for organisations deploying AI agents

A note for Brazilian readers

Brazil's regulator is preparing to address agents too. In July 2026, the ANPD and the UN Development Programme opened calls for consultants to produce technical studies, one of them on “AI agents in the context of personal data protection”. According to Capital Digital, the study will map how far these technologies have developed and provide technical input for future ANPD regulatory initiatives. In the meantime, the LGPD (Law 13.709/2018) already applies: its Article 20 gives people the right to request a review of decisions made solely on the basis of automated processing, and that right doesn't disappear because an agent, rather than a single model, made the decision.

The bottom line

AI agents are useful precisely because they act without being told every step. That is also why regulators are paying attention: the more autonomy a system has, the more an organisation needs to know what it can access, what it remembers, whom it talks to and who answers for it. None of this requires new law. The GDPR's familiar principles of lawfulness, transparency, minimisation, security and accountability already apply. What changes is the engineering needed to honour them. Book a free consultation with GDPRGard → and we will help you map your agents' permissions, memory and data flows before the guidance lands.

Sources

The ICO, CNIL and AEPD positions above are summarised from the sources listed. Statements about what the ICO “expects” or “suggests” reflect its call for evidence and are not binding rules. Analysis of how they fit together is ours.

Share this article

Also read:

⚠️ This article is for informational purposes only and does not constitute legal advice. For complex compliance situations, consult a qualified data protection professional. GDPR and EU AI Act requirements are subject to ongoing regulatory guidance — verify current obligations with your legal adviser.