Agentic AI and GDPR: What Every Product Owner Needs to Know

The inevitable collision between autonomy and regulation

Agentic AI and GDPR appear contradictory: on one side, agents that process data, make automated decisions, access multiple systems; on the other, a regulation requiring consent, transparency, data minimisation and the right to object.

The good news: this tension is manageable. Here is the practical framework I developed for Product Owner and IT teams in Switzerland.

Five GDPR risks specific to AI agents

Risk 1 — Automated decision-making (Article 22 GDPR)

If your agent makes decisions with a legal or significant impact on individuals (credit scoring, HR selection, dynamic pricing), Article 22 applies: you must allow the person to request human review. Document this possibility in your processing register.

Risk 2 — Undefined purpose

An agentic agent may access many systems. But GDPR requires each processing to be limited to a specific, explicit and legitimate purpose. Define precisely, for each agent, which data it can access and why.

Risk 3 — Excessive retention of context data

Memory-enabled agents store context — which may contain personal data. Apply minimisation and retention limitation principles to agent memories just like any other database.

Risk 4 — Unintentional cross-border transfers

If your agent uses an LLM hosted outside the EU, every request containing personal data potentially constitutes a cross-border transfer. Verify your provider's contractual guarantees (Standard Contractual Clauses).

Risk 5 — Absence of audit logs

In the event of a data breach involving an AI agent, you must be able to reconstruct exactly what data was processed, when, and for what reason. Without structured logging, this is impossible.

The GDPR framework for Product Owners

• ✅ Legal basis documented for each agent processing activity
• ✅ DPIA (Data Protection Impact Assessment) completed if high-risk processing
• ✅ Processing register updated with the agent as a new processing activity
• ✅ Logging of all agent actions on personal data
• ✅ Rights exercise procedure updated (access, rectification, erasure)

"GDPR doesn't ban agentic AI. It requires thinking before you deploy, not after the first incident."