AI agents and the GDPR: how to use AI responsibly within European rules
AI agents and the GDPR: for many business owners, it's the subject that raises the most questions. Understandably so, because an agent works with customer data, quotes and sometimes sensitive information. It reads emails, searches your CRM and makes decisions. You want to be sure you're staying within the rules.
The good news: the rules are clear and easy to apply. The GDPR has been around for years and doesn't change fundamentally because of AI. On top of that, the EU AI Act, Europe's AI regulation, has come into force step by step. For most applications in sales, service and administration, the requirements are manageable.
Please note: this page gives a practical overview and is not legal advice. If in doubt, get advice from a privacy lawyer or your data protection officer.
Why privacy and AI need extra attention
A classic software package does what you tell it to. An AI agent works more independently. It decides which information to look up, combines data from different sources and makes decisions. That makes it powerful, but it also calls for extra care.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens), which supervises privacy in the Netherlands and coordinates algorithm oversight, calls on organisations to use AI with care. On the AP's topic page on algorithms and AI you'll find current guidelines and publications. Want to know more about agents in general first? Then read our page on AI agents.
Three characteristics of agents make privacy and AI a special topic.
What the GDPR requires for AI agents
The GDPR makes no distinction between AI and other software. The familiar principles simply apply. With AI agents, five topics deserve extra attention.
-
A valid legal basis
You need a legal basis for every processing of personal data. For AI agents in sales and service, that's usually the performance of a contract or a legitimate interest. Consent is rarely needed, but check which legal basis fits each application and record it.
-
Data minimisation
Only give an agent access to the data it needs for its task. An agent that schedules deliveries doesn't need access to salary data or medical information. Set the permissions for each agent as narrowly as possible.
-
A data processing agreement
If an external party processes personal data on your behalf, you need a data processing agreement. With AI agents, that applies to your software vendor and often to the provider of the language model as well. A data processing agreement for AI must make clear where the data is processed, whether the provider uses your data to train models and how long data is retained.
-
A DPIA for high risk
A data protection impact assessment, or DPIA, is mandatory if processing is likely to result in a high risk to the people involved. For an agent that answers customer questions, that's usually not the case. For an agent that makes decisions about job applicants, creditworthiness or large-scale profiling, it is. In doubt? Carry out the DPIA anyway. It also helps you get a clear picture of the risks.
-
Rights of data subjects
Customers and staff keep their rights, such as access, rectification and erasure. Make sure you can trace which data an agent has processed. For automated decisions with significant consequences, data subjects also have the right to human intervention.
The EU AI Act: what applies now?
The EU AI Act, the European AI regulation, is the world's first comprehensive AI law. It classifies AI applications by risk and sets requirements that increase as the risk grows. The obligations are being phased in.
The four risk categories
| Category | Examples | What it means |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative techniques | Prohibited |
| High risk | Recruitment and selection, credit assessment, education | Strict requirements for documentation, oversight and quality |
| Limited risk | Chatbots and AI agents that communicate with customers | Transparency obligation |
| Minimal risk | Spam filters, internal summaries | No specific requirements |
Most AI agents for sales, customer service and administration fall into the limited or minimal risk categories. If you use an agent to assess job applicants or creditworthiness, you move into high risk.
What already applies
- Bans on prohibited practices have applied since February 2025.
- AI literacy has been mandatory since February 2025. Organisations that use AI must make sure their staff have enough knowledge to work with it responsibly.
- Transparency obligations have applied since August 2026. People must know that they're communicating with an AI system, and AI-generated content must be recognisable as such in certain cases.
Where is your data processed?
This may well be the most important question for GDPR-compliant AI. An agent consists of two layers: the software it runs in and the language model that lets it think. Those two can be in different places.
The three scenarios
| Scenario | Where the data goes | What to check |
|---|---|---|
| Model hosted by your software vendor in the EU | Stays within your vendor's environment | Simplest from a GDPR point of view |
| External model via your vendor | To the model provider, possibly outside the EU | Check the region, retention periods and training on your data |
| Your own integration with an external provider | Directly to that provider | You're responsible for the agreements yourself |
Liability and human oversight
What happens if an agent makes a mistake? It sends the wrong quote, gives incorrect advice or accidentally changes a customer record. Legally, the answer is usually clear: you, as an organisation, are responsible for the systems you use. An agent is a tool, not an independent legal entity.
That's why human oversight isn't a formality, but a core part of responsible use.
How to set up oversight
Zoho, Creatio and the GDPR
Both Zoho and Creatio pay a lot of attention to privacy and give European customers the means to work in line with the GDPR. Even so, your own configuration remains decisive.
GDPR-compliant AI with a private AI environment
For some organisations, a standard AI service isn't enough. Think of companies that work with sensitive customer data, confidential contracts or strict requirements from clients. For them, Mobile XL offers a GDPR-compliant AI environment: a private environment in which AI runs in a European data centre, shielded from public AI services.
That way you combine the possibilities of modern AI with the certainty that your data stays within European rules. You'll find more information on our page about the GDPR-compliant AI environment.
-
Data within the EU
Processing takes place in a European data centre. You know exactly where your data is.
-
No training on your data
Your business information isn't used to improve public models.
-
Integration with your own systems
The environment is connected to your existing sources, such as your CRM or database, with exactly the permissions needed.
-
Full control
You decide who has access, which data is available and how long data is retained.
Checklist: how to make your AI agents GDPR-compliant
Use this checklist for every new agent you put into use.
- I've recorded which personal data the agent processes and for what purpose.
- I've determined a valid legal basis for each application.
- The agent only has access to the data it needs.
- I know where the language model runs and whether that's within the EU.
- I have data processing agreements with my software vendor and the model provider.
- It's been put in writing that my data won't be used to train models.
- I've assessed whether a DPIA is needed, and carried one out where necessary.
- Customers know that they're communicating with an AI agent.
- Customers can always easily ask for a member of staff.
- The agent's decision-making scope and checkpoints have been defined.
- All of the agent's actions are logged.
- There's an owner who monitors and adjusts the agent.
- Staff who work with the agent have had sufficient AI training.
You can read how to work this into an implementation project in implementing an AI agent. For specific applications, you can also look at AI agents in sales and CRM and process automation with AI agents.
Privacy was our biggest concern. Now we know exactly which data the agent uses and where it stays, and that gives us peace of mind.
Innovating responsibly with AI
AI agents and the GDPR go together perfectly well, as long as you make the right choices. With a clear configuration, transparency towards customers and good human oversight, you can harness the power of AI without worrying about privacy. Mobile XL helps SMEs in the Netherlands and Flanders set up AI agents in Zoho and Creatio in a GDPR-compliant way, and offers a private AI environment within the EU for organisations with extra-high requirements.
Frequently asked questions about AI agents and the GDPR
-
Yes. The GDPR doesn't prohibit AI, but it does set requirements. You need a valid legal basis, limit processing to what's necessary, sign data processing agreements and respect the rights of data subjects.
-
The EU AI Act is the European AI regulation. The law classifies AI applications by risk. For most agents in sales and service, it mainly means a transparency obligation and the obligation to give staff sufficient AI knowledge.
-
Usually the limited or minimal risk category. Agents that make decisions about job applicants, creditworthiness or access to education do count as high risk.
-
Yes. The AI Act's transparency obligation has applied since August 2026. Customers must know that they're communicating with an AI system. Also make sure they can always easily speak to a member of staff.
-
Yes, if an external party processes personal data on your behalf. That applies to your software vendor and often to the provider of the language model as well.
-
That depends on the language model. With a model that your vendor hosts itself in the EU, your data stays within that environment. With an external model, the data goes to the model provider, possibly outside the EU.
-
Only if the processing is likely to result in a high risk, such as large-scale profiling or decisions about job applicants or credit. If in doubt, it's wise to carry out the DPIA anyway.
-
As a rule, the organisation that deploys the agent. That's why human oversight, clear decision limits, logging and good agreements with your vendor are so important.
-
Limit access to the data that's needed, preferably choose a model that runs within the EU, sign data processing agreements, be transparent with customers and set up human oversight and logging. For sensitive data, a private AI environment within the EU is the safest choice.
-
Both platforms give European customers the means to work in line with the GDPR, such as data processing agreements and access management. Whether your use is GDPR-compliant depends on your own configuration, such as the choice of language model and the agents' permissions.
Want to be sure your AI applications comply with European rules?
Book a no-obligation call and we'll go through your situation together.