AI Agents and GDPR: Legal Basis, Automated Decisions and DPIAs

Who is responsible

The organisation that decides to use an agent for its own purposes is the controller (Art. 4(7)). An agent platform or model provider that processes the data on your behalf is a processor (Art. 4(8)) and needs a data processing agreement with the Article 28(3) terms. If the provider also uses your prompts or outputs for its own purposes, such as training its models, it acts as a controller for that use, and you must check whether your legal basis and privacy notice cover the disclosure.

Check the terms: many agent and model services offer an option, or a business plan, under which customer data is not used for training. Choose it where you can and record the choice in your records of processing (Art. 30).

A legal basis for each purpose

Every processing purpose needs its own basis under Article 6(1). For agents at work, the usual candidates are contract (an agent that handles a customer's own request), legal obligation (for example screening required by law) and legitimate interests. There is no hierarchy between them; the controller chooses and documents the right one.

For legitimate interests, EDPB Opinion 28/2024 on AI models restates the three-step test: the interest must be lawful, clearly articulated and real and present; the processing must be necessary for it, with no less intrusive way; and the interest must not be overridden by the rights of the people concerned. Reasonable expectations weigh heavily in the last step: people should not be surprised by what an agent does with their data. Special category data (health, beliefs and so on) also needs an Article 9(2) condition.

Automated decisions: Article 22

People have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects for them (Art. 22(1)). An agent that rejects a job application, a loan or an insurance claim without meaningful human review falls under it.

Question	What the law and case law say
Is a score a decision?	Yes, if it is decisive. In SCHUFA (C-634/21, 7 December 2023) the CJEU held that automatically establishing a probability value is an automated decision where a third party draws strongly on it to establish, implement or terminate a contract.
When is it allowed?	Only if necessary for a contract, authorised by law with safeguards, or based on explicit consent (Art. 22(2)). Special category data needs explicit consent or a substantial public interest (Art. 22(4)).
Which safeguards?	For the contract and consent cases: at least the right to obtain human intervention, to express one's point of view and to contest the decision (Art. 22(3)).
What must you explain?	The existence of the automated decision and meaningful information about the logic involved and its consequences (Arts. 13(2)(f), 14(2)(g), 15(1)(h)). In Dun & Bradstreet Austria (C-203/22, 27 February 2025) the CJEU held this means explaining the procedure and principles actually applied, in a concise and intelligible form; trade secrets go to the authority or court, which balances the interests.

Human review must be real: a reviewer who confirms every output without the authority or information to change it does not take the decision out of Article 22 (WP29 Guidelines on automated decision-making, WP251 rev.01, endorsed by the EDPB).

When you need a DPIA

A data protection impact assessment is required where processing, in particular using new technologies, is likely to result in a high risk (Art. 35(1)). It is always required for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based (Art. 35(3)(a)). Under the EDPB-endorsed WP248 rev.01 guidelines, innovative use of technology is itself one of the nine criteria, and meeting two criteria usually means a DPIA. Many agent deployments that touch customers or staff will meet two.

Do the DPIA before the agent goes live, and record the agent's data sources, tools and permissions, what it can decide alone, and how people can reach a human. Our free DPIA Helper runs the screening.

If you use someone else's model

EDPB Opinion 28/2024 looks at what happens when a model was trained by unlawfully processing personal data. Where the model still contains personal data and another controller deploys it, authorities should consider whether the deploying controller carried out an appropriate assessment, as part of its accountability under Articles 5(1)(a) and 6, that the model was not developed unlawfully. That assessment looks at the source of the training data and whether a supervisory authority or court has found an infringement, and should be more or less detailed depending on the risks of your use.

In practice: ask your provider how training data was obtained, keep its answer, and check public decisions against it before you deploy.

Logs, memory and security

Minimisation: give the agent access only to the data and tools its task needs (Art. 5(1)(c), 25).
Retention: prompts, outputs, tool-call logs and agent memory are personal data when they concern people. Set a retention period for each (Art. 5(1)(e)) and include them in access and erasure requests.
Security: an agent that can send email or query databases is an attack surface. Prompt injection that makes it leak data is a personal data breach (Art. 4(12)), with the 72-hour notification rule (Art. 33). See securing MCP servers and agent tools.
Transfers: if the provider processes data outside the EEA, you need a transfer tool under Articles 44 to 49.

The AI Act alongside the GDPR

The AI Act does not replace the GDPR. For most companies using agents, its transparency rules apply since 2 August 2026: people must be told when they interact with an AI system unless that is obvious (Art. 50(1)), and AI-generated deepfakes must be disclosed (Art. 50(4)). Obligations for high-risk uses, such as recruitment or credit scoring, apply from 2 December 2027 after the 2026 Digital Omnibus. See the AI Act timeline.

Checklist before an agent touches personal data

Step	Article
Decide who is controller and processor; sign a DPA with the agent or model provider	Arts. 4(7)-(8), 28
Record a legal basis per purpose; for legitimate interests, document the three-step test	Art. 6(1); EDPB Opinion 28/2024
Check whether the agent decides alone with significant effects; add human review or an Art. 22(2) exception and safeguards	Art. 22
Update the privacy notice, including the logic of any automated decision	Arts. 13, 14
Screen for a DPIA and do it before go-live	Art. 35
Assess the model's lawful development; keep the provider's answers	Arts. 5(1)(a), 5(2), 6
Limit tools, data and memory; set retention for prompts, logs and memory	Arts. 5(1)(c), 5(1)(e), 25
Test for prompt injection and data leakage; plan breach response	Arts. 32, 33

Templates for the paperwork. The Privacy Impact Assessment Bundle includes a DPIA template, a screening checklist and a risk register you can use for an agent deployment.

AI Agents and GDPR: Legal Basis, Automated Decisions and DPIAs

Who is responsible

A legal basis for each purpose

Automated decisions: Article 22

When you need a DPIA

If you use someone else's model

Logs, memory and security

The AI Act alongside the GDPR

Checklist before an agent touches personal data

Sources

Related tools

GDPR DPIA Helper

Data Flow Mapping Tool