AI and the GDPR: what the law asks of AI agents.

The GDPR does not ban AI agents. It asks for the same as with any other processing of customer data: a reason, transparency, a contract with the service provider, security, and no more data than needed. With an agent, two points come on top that do not matter for a simple contact form: it can act on its own, and it talks like a person.

Every processing needs a basis from Art. 6 GDPR. In customer service this is often the performance of a contract or steps before one (Art. 6(1)(b)): someone asking about their order wants it handled. For other purposes, a legitimate interest (point (f)) can apply if it is weighed against the customers’ interests. Consent (point (a)) mainly comes into play when none of these bases applies – for example if conversation data is to be used to improve a model.

Art. 13 GDPR requires that customers learn, when their data is collected, who is responsible, what the data is processed for, on what basis, who receives it and how long it is kept. For an AI agent this means in practice: the privacy notice names the agent, the provider of the language model, where processing takes place and how long conversations are kept.

If a service provider runs the agent or supplies the language model, first clarify its role. If it processes the data only on your instructions and for your purposes, it is a processor. If it sets purposes of its own, such as training its own models, it is itself a controller for that processing (Art. 4(7) and (8), Art. 28(10) GDPR). For processing on your behalf, Art. 28 GDPR requires a contract. In it, pay particular attention to these points:

The GDPR does not require servers to be in Germany. It does regulate when data may go to a country outside the European Economic Area (EEA) (Art. 44 et seq.). The EEA is the EU member states plus Iceland, Liechtenstein and Norway. A transfer to a third country is allowed on one of three routes: with an adequacy decision of the European Commission (Art. 45), with appropriate safeguards such as standard contractual clauses (Art. 46), or in exceptional cases under Art. 49, for example with explicit consent. The exceptions are meant for specific individual cases, not for day-to-day operation.

Art. 22(1) GDPR gives people the right not to be subject to a decision made solely by automated means that has legal effects on them or similarly significantly affects them. Whether a step falls under this depends on its consequences for the customer, not on the type of task. A status update usually has no such effect. Moving an appointment can have it, for example if a deadline or a service is lost as a result. Refusing a cancellation, denying a refund or changing a contract usually has legal effect.

Art. 35 GDPR requires an impact assessment when processing is likely to result in a high risk for the people concerned. For an AI agent, signs of this are: new technology, many people affected, sensitive data (such as health or finances) or automated decisions with effect. An agent that only answers general questions often does not need one; one that acts in customer accounts is more likely to. Write down your reasoning even if you conclude it is “not needed”.

Alongside the GDPR, the EU’s AI regulation applies, Regulation (EU) 2024/1689 (Artificial Intelligence Act, AI Act). Its Art. 50(1) requires that people learn they are talking to an AI system – unless this is obvious from the circumstances. This obligation applies since 2 August 2026. A short note at the start of the chat is usually enough, such as “You are chatting with an AI”.