Guide30 September 20265 min read
AI agents and GDPR: what EU businesses should check before automating customer conversations
A practical checklist for owners and managers: data, boundaries, providers and oversight.
By Michael PresecanAIgenica
AI agents that answer customers and handle requests process personal data, so the GDPR applies. That is no reason to avoid them, but it is a reason to set them up carefully. Here is the checklist we use with clients. It is practical guidance, not legal advice.
1. Know what data the agent sees
List what customers will share: names, contact details, booking details, sometimes more. Design the conversation so the agent asks only for what the process needs. Keep special categories of data, such as health information, out unless there is a clear legal basis and extra safeguards.
2. Have a Data Processing Agreement
If an agency or platform operates the agent for you, they act as your processor. You need a DPA that covers the purpose, the data, security measures and sub-processors. Ask for the list of sub-processors and where they process data.
3. Check international transfers
Find out where the platform and its AI model providers process data. Transfers outside the EEA need a safeguard such as an adequacy decision or Standard Contractual Clauses.
4. Write boundaries in plain language
Decide what the agent may answer and do, and what it must hand over to a person. Answers should come only from content you approved, with sources. This protects your customers and your business.
5. Be transparent
Tell people they are talking to an AI assistant and offer an easy route to a human. Update your privacy policy to describe the processing.
6. Keep oversight
Every conversation and action should be visible to your team. Review samples regularly, especially early on, and fix the knowledge when answers are not good enough.
7. Limit retention
Decide how long conversations are kept and delete them afterwards. Keep only what you need for the purpose.
How we handle it
We are an EU company and build on SuperCognit, a European agent platform. Every client gets a separate workspace, our DPA is published, sub-processors are listed, and every agent has written boundaries, approved knowledge and a handover to people.
