Technology
What an AI agent is, why autonomous actions matter more for privacy than chatting, the risks involved and what to arrange before it starts work.
An AI agent may do with personal data what an employee would be allowed to do for the same task, and no more. There must be a purpose and a lawful basis, the agent receives only the data the task requires, and it does not make a decision with major consequences for someone on its own. The organisation deploying the agent remains responsible.
This becomes difficult because AI agents choose their own route. With a chatbot, you decide what goes in. With an agent, the model decides which email it opens, which file it reads and what it does next. Our main page on AI chatbots and the GDPR explains the position for data you paste into a chat window yourself.
An AI agent is an assistant given a goal rather than a question, which works out for itself which steps are needed. It uses tools to do this: a search function, a calendar, an inbox, a folder or a browser.
Anthropic, the company behind Claude, distinguishes two kinds of systems in its explanation of building agents. In a workflow, the model and tools follow a route predefined by a programmer. In an agent, the model directs its own process and tool use. It plans, acts, examines the result and decides what to do next.
A chatbot without tools does neither: it answers what you type. The difference lies in what is built around the language model, rather than in the model itself.
Three things turn a language model into an agent.
Anthropic also describes the downside: errors can accumulate. Its advice is to build in stopping conditions and test in an isolated environment.
Think of an agent that reads incoming email, finds the relevant client file and prepares a draft reply. Or an agent instructed to “schedule a meeting with the three people involved”, which looks through calendars and email exchanges to do so. In both cases, the agent reads more than the task strictly requires. That is where the privacy question starts.
Because an agent has access, takes action and often does so out of sight. With a chatbot, the risk is what an employee enters. With an agent, the risk is what it can reach for itself.
An agent scheduling a meeting needs read access to calendars. In practice, it often gets the whole inbox. Anything it can read may end up in the conversation with the model and therefore with the model provider. Microsoft 365 Copilot and the GDPR explains how broad such access can become.
On 12 February 2026, the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, warned of major security risks with AI agents. The trigger was an open-source platform whose users gave an assistant full access to their computer, including email, files and online services. According to the AP, such an assistant can act independently, without direct prior human approval.
The AP urged people not to use such experimental agents on systems containing sensitive or confidential data, such as client records, personnel data and identity documents. It also said that organisations and users remain responsible for meeting GDPR requirements themselves.
On 20 July 2026, the French supervisory authority CNIL published an exploratory note on agentic AI. According to the CNIL, agents draw data from many sources and cause personal data to circulate between services. Users find these flows difficult to oversee. The note is exploratory, rather than guidance.
The same as any other processing, but some become more pressing. The articles below appear in the GDPR text. Read a broader explanation in GDPR legislation explained.
Article 5(1)(b) says that personal data must be collected for specified, explicit purposes and not further processed in an incompatible manner. An agent looking in an inbox to schedule a meeting may not use what it reads for something else. The model does not inherently understand that distinction: you define the purpose and align permissions with it.
Article 5(1)(c) requires data to be limited to what is necessary. Article 25(2) adds that default settings must ensure only data necessary for the purpose is processed, including with regard to accessibility. For an agent, that means its default access is narrow.
Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal effects on them or otherwise significantly affects them. There are three exceptions: the decision is necessary for a contract, authorised by law, or based on the data subject's explicit consent. For the first and third exceptions, the data subject has at least the right to human intervention, to express their point of view and to contest the decision. On its page about rules for using AI and algorithms, the AP calls this the right to a human perspective.
Not every action by an agent is such a decision. In its guide to agentic AI (version 1.1, February 2026), the Spanish supervisory authority AEPD writes that an agent gathering news and sending summaries does not make a decision within Article 22. An agent rejecting an applicant, refusing an application or blocking a customer may do so. The boundary depends on the consequences for the person. This requires an assessment by your data protection officer or a lawyer. For personnel matters, read more in AI in HR.
An agent rarely involves just one party. There is a model provider, often a provider of the platform the agent runs on, and the services to which it connects. Article 28 requires an agreement with every party processing personal data on your behalf. An employee's personal account does not have one. Read what it should contain in Data processing agreement with an AI provider.
Three risks recur in almost every source: excessive permissions, prompt injection and the absence of a trace. In addition, an agent's error is an action rather than a wrong answer: an email sent to the wrong recipient is a personal data breach. See What is a data breach?.
An agent allowed to do everything is quick to set up. It is also a master key. The AEPD identifies least privilege as the starting point for agentic AI: an agent receives only the access its task requires, for the duration of that task.
A language model reads text and cannot always distinguish an instruction in that text from an instruction from you. The AEPD describes the indirect variant: instructions invisible to a human, hidden in a PDF, email or webpage, which the model interprets as something to execute. In its warning, the AP describes what an attacker can achieve this way: taking over accounts for connected services, reading emails and local files, and stealing access codes.
In its safety advice for building agents, OpenAI writes that agents can still make mistakes and be misled even with safeguards, and recommends having the user confirm every action. The risk is greatest for an agent that reads confidential data, processes external text and can send things.
A chatbot has a conversation you can reread. An agent has dozens of intermediate steps: which files it opened, which searches it ran, what it sent. If nobody records this, you cannot say which data was used when an access request or incident occurs. Article 5(2) requires you to demonstrate that you meet the rules. Without a log, you cannot.
A setup reference table: the risk and measure for each capability.
| What the agent can do | Risk | Measure |
|---|---|---|
| Read email and calendars | It reads more than the task requires; content goes to the model provider | Access per folder or label; business account with a data processing agreement |
| Search files and client files | Confidential documents enter the conversation | Only project folders; searching rather than browsing |
| Open webpages and attachments | Hidden instructions in the text (prompt injection) | Do not combine confidential access, external text and sending permissions without approval |
| Send email or messages | Data leaves the organisation unchecked | Prepare a draft; a human sends it |
| Change or delete files | Irrecoverable errors | Read-only by default; version control; reversible actions |
| Make decisions about a person | Automated decision without human intervention | A human decides; the agent prepares |
| Remember between sessions | Data is retained longer than necessary | Memory per task; retention period; demonstrable deletion |
| Add plug-ins or connections | An unknown party gains access | List of permitted connections; only administrators may add them |
Check these steps before the first agent gains access to real data.
An agent an employee installs on their own laptop bypasses all these steps. That is shadow AI in its most serious form.
The EU AI Act has no separate category for agents. Whether requirements apply depends on the system's purpose. In its warning, the AP calls for European clarification that autonomous AI agents fall under the AI regulation.
If an agent is deployed for a high-risk application, such as selecting applicants, additional requirements apply, including human oversight. According to the European Commission's timeline, the rules for those high-risk systems apply from 2 December 2027 following the digital omnibus amendment. The GDPR already applies. Read about the regulation's status in The AI Act explained.
For an AI agent, PrivaSearch is a tool with a narrow range of functions. A connected assistant can search documents, but cannot browse, write or send anything. It calls a search function with a project and query and receives at most eight passages, each with a short source reference. Opening a source is a second function, returning one passage of at most 1,200 characters. No file, filename or link. The steps appear on the page about AI chatbots and the GDPR.
Passages come only from text in which personal data has been replaced with pseudonyms and which a colleague has checked and approved. Until that approval, a document is not searchable, including by a connected assistant. If the search query still contains a name, it is replaced before searching. Pseudonymised data remains personal data for your organisation. The difference from anonymisation appears in Pseudonymisation or anonymisation.
With every request, PrivaSearch checks who is asking: a valid token from an active user with two-factor authentication, who is a project member and has completed AI training. For a SharePoint library, it checks live whether that user may still view the document there. If one check fails, the assistant receives nothing. Actions are logged without document content in the log. Read more in How PrivaSearch works and the security measures.
Connections are available for Claude (in the browser, desktop app and Claude Code), ChatGPT Business and Mistral Vibe (formerly Le Chat). The connection does not resolve two things. What PrivaSearch returns becomes part of the conversation and reaches the assistant provider, under its retention policy. And you determine what else the agent is allowed to do with other sources and tools. PrivaSearch limits only its own part.
Want to see what an assistant receives through the connection? Book a demo.
An AI agent is a language model given a goal that determines for itself which steps are needed. It uses tools such as a search function, inbox or calendar, examines each step's result and chooses the next. Unlike a chatbot, an agent does more than return text: it also performs actions, sometimes without anyone approving every step in advance.
A chatbot responds to what you enter. AI agents retrieve data and perform actions themselves, within the permissions they have received. With a chatbot, the user determines which data goes to the model. With an agent, the model determines this, and often nobody sees the intermediate steps. That is why access permissions, human approval and logging matter more for agents.
Not automatically. The GDPR gives people the right not to be subject to a solely automated decision that significantly affects them. There are exceptions, such as a decision necessary for a contract, but the data subject then has a right to human intervention. Whether an agent's action is such a decision requires a legal assessment of each case.
Prompt injection is a hidden instruction in text the agent reads, for example in an email, PDF or webpage. The model may mistake it for an instruction and try to execute it. For an agent with access to email and files, that may mean data being read or forwarded. Limit permissions and have a human approve what leaves the organisation.
The organisation deploying the agent. Under the GDPR, it is the controller, even if the agent acted independently and even if it comes from a supplier. The Autoriteit Persoonsgegevens said this explicitly in February 2026: organisations and users remain responsible for meeting GDPR requirements themselves. If an agent sends data to the wrong recipient, assess it as a data breach.
Yes, with every party processing personal data on your organisation's behalf. For an agent, that is often more than one: the language model provider, the platform it runs on and sometimes the connected services. An employee's personal account usually lacks such an agreement. Use a business account and record the parties in your record of processing activities.
How retrieval-augmented generation works, how it differs from uploading and fine-tuning, why it reduces errors and which privacy questions to ask.
What the Model Context Protocol is, how a connection differs from uploading a file, what an assistant receives and which risks you should check.
What a language model does, what tokens and a context window are, why a model invents things and what it does and does not remember from your input.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →