GDPR and AI Agents: A Business Launch Checklist

Deploying an AI agent under the General Data Protection Regulation, or GDPR, means evaluating the service’s actual use of personal data. Start with the customer task, then check the lawful basis, information collected, recipients, retention, rights procedures, and supplier arrangements.

This is general planning information reviewed on September 16, 2026. Use a qualified privacy adviser for the decisions that depend on your jurisdiction and processing. The checklist does not certify any platform or replace a deployment-specific assessment.

When can GDPR apply to a customer agent?

GDPR can apply to organizations established in the European Economic Area and, in certain circumstances, organizations elsewhere offering goods or services to people there or monitoring their behavior. Conversation text, contact details, booking references, and identifiable attachments can be personal data. The EDPB’s basics guide explains the scope.

Illustrative example: a travel advisor’s agent collects dates, interests, contact information, and accessibility preferences to prepare a trip proposal. The advisor should assess each field’s purpose. Some volunteered information may reveal health details, which requires additional consideration under the rules for special-category data.

What should the data map contain?

Map the complete path from the customer’s input to the final result. Include suppliers that process information behind the customer interface.

Stage	Questions to resolve	Evidence to keep
Collection	Which fields and attachments are necessary?	Approved intake requirements
AI processing	Which platform and model providers receive data?	Current provider terms and processing description
Connected actions	What goes to the calendar, CRM, or other system?	Connection scope and destination
Storage	Where are conversations, summaries, logs, and files held?	Retention and access documentation
Rights request	Who locates, corrects, exports, or removes records?	Tested procedure and responsible person
End of service	What is returned or deleted, and when?	Contract terms and exit procedure

This inventory also exposes avoidable processing. A first itinerary discussion may work without a passport scan. Keep unnecessary information out of the initial service.

Who is responsible for each part?

Identify controller and processor roles from what each party actually does. The controller determines purposes and means; a processor handles data on the controller’s behalf. A provider may have different roles for different processing activities. The EDPB’s controller and processor guidelines explain that assessment.

Where a supplier acts as processor, check the required Article 28 arrangement. Ask for the applicable agreement, subprocessors, assistance with rights requests, security commitments, and end-of-contract handling. Review whether customer data may be used for the supplier’s own purposes, including model improvement. Avoid inferring those answers from how the product is marketed.

Which legal questions need decisions before launch?

Document a lawful basis for each processing purpose. Answering a customer’s service request, keeping an operational record, and sending future marketing are separate purposes to assess. Consent should not become a blanket checkbox covering everything.

Provide privacy information that explains the actual processing in accessible language. Apply minimization, appropriate security, and justified retention. Articles 5, 6, 13, 14, 25, and 32 of the GDPR text provide the relevant starting points. Special-category information also needs an applicable Article 9 condition.

For the travel example, write down why the agent asks each question and whether the answer must be stored after the proposal is delivered. Keep optional personalization separate from information necessary to fulfill the request.

Can customers exercise their rights in practice?

Give a responsible person a working process for access, correction, erasure, restriction, objections, and applicable portability requests. These rights have conditions and exceptions. Requests generally require a response within one month, with extensions possible in qualifying circumstances; the EDPB rights guide explains the details.

Test the process using fictional records. Search every relevant system, verify the requester appropriately, and document the response. Ask suppliers how they assist and what deletion covers, including backups and derived records.

Deleting a chat may leave its summary in another application. Model training is a separate question to establish with the supplier. Do not assume every conversation changes model weights or that deleting a visible record guarantees removal from every processing system.

What about international transfers and automated decisions?

Check transfers and access outside the European Economic Area across the full supplier chain. GDPR provides mechanisms for permitted transfers; it does not impose a blanket rule that all personal data remain in the EU. Review the applicable mechanism and safeguards with your adviser. The EDPB transfer guide is the primary reference.

Article 22 concerns solely automated decisions with legal or similarly significant effects and includes defined exceptions and safeguards. A routine answer and a decision affecting someone’s access to an essential service deserve different analysis. Human involvement must be meaningful where relied upon. See the EDPB rights guidance.

When should you perform an impact assessment?

Perform a data protection impact assessment, or DPIA, before processing likely to result in high risk. Assess the nature, scope, context, and purpose, and consult your supervisory authority’s criteria. The EDPB compliance guide covers this process.

Also plan incident handling. Identify who receives supplier alerts, investigates affected records, and assesses notification obligations. Avoid treating a breach-notification deadline as an acceptable detection delay.

What must an Agentplace buyer verify?

Agentplace can provide a customer-facing agent with its own interface and URL. Before using personal data, review its privacy policy, terms, and the contractual and technical information relevant to your configuration.

This article does not verify a data processing agreement, subprocessor list, processing region, retention setting, training restriction, or GDPR certification for your account. Obtain confirmation of requirements that are material to your service. If a required control remains unresolved, keep the pilot on fictional data or narrow the task.

Use the data access worksheet to prepare a reviewable setup. A useful first step is a public-information agent tested with fictional requests, followed by a documented decision about which real customer data it may process.