GDPR for AI agents: residency and processors

What changes when an agent touches personal data

GDPR has no special chapter for AI agents. Its rules attach to the processing of personal data, whoever or whatever carries it out. What changes in practice is the shape of the processing. A person who looks up a customer record touches one record for one reason. An agent can read thousands of records, call other systems and pass text to a language model, in a loop nobody watches. The questions in this article are therefore the familiar GDPR questions, asked of a system that moves faster and across more parties than a person does.

Residency is a location question, processors are a contract question

Data residency answers where personal data is stored and processed. It does not by itself answer who may process it or on what terms. Article 28 deals with that second question: where processing is carried out on behalf of a controller, the controller must use only processors providing sufficient guarantees, and the processing must be governed by a contract or other legal act. Location matters mainly through Article 44, which allows a transfer to a third country only if the conditions of that chapter are met. An EU region is a useful starting point, not a compliance conclusion. The model provider, the logging service and the monitoring tool are all part of the data path.

Questions, articles and the evidence to keep

The table turns the main GDPR duties into questions you can answer for an agent project, with the Regulation article each comes from and the evidence worth keeping. It is a working aid for conversations with your data protection officer or lawyer, not a full compliance programme.

A processor checklist for an agent project

Use the list in this order. It starts with the data path because the later steps only make sense once you know which parties are in it.

1. Map the data path: every system, model endpoint, log store and vendor that sees the agent's inputs, prompts, outputs and traces.
2. For each party, decide whether it acts as a processor on your behalf, and confirm a contract covers the Article 28(3) points, including processing only on documented instructions.
3. Obtain each processor's current list of further processors and agree how it will tell you about changes, so you can object.
4. Record where each party stores and processes data, and the transfer basis for anything outside the EU or EEA.
5. Check the security measures against Article 32 and agree how and how quickly you will hear about a personal data breach, since your own notification period runs from when you become aware.
6. Agree deletion or return of the data at the end of the service, and your rights to information and audits.
7. Decide on the impact assessment, update your records of processing, and keep agent logs that let you answer a data subject's request.

Models, prompts and the EDPB's view

The European Data Protection Board addressed AI models in Opinion 28/2024 of 18 December 2024, issued under Article 64(2) at the request of the Irish supervisory authority. Two points matter for a company that deploys rather than builds. First, the Board considers that AI models trained with personal data cannot, in all cases, be considered anonymous; a claim of anonymity has to be assessed case by case. Second, where another controller deploys a model that retains personal data, supervisory authorities should take into account whether the deployer made an appropriate assessment that the model was not developed by unlawfully processing personal data. In practice, ask the model provider for documentation instead of assuming the model is anonymous. The opinion is about models and controllers, so it does not replace the processor work above.

When an impact assessment is required

Under Article 35(1), where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out an assessment before the processing. Article 35(3) names cases that always require one, including systematic and extensive evaluation of personal aspects based on automated processing on which significant decisions are based, and large-scale processing of special categories of data. Many internal agents will not reach that bar, and an agent that never sees personal data may need none. An agent that drafts replies to customers from their order history is an example where the question deserves a real look. Whether yours does is a legal judgement. Record the reasoning either way, because the assessment, when needed, must be done before the agent goes live.

How EUHub hosts its own workloads

EUHub's own production workloads run on Microsoft Azure Container Apps in the Germany West Central region, in Germany, inside the EU. For client work the hosting region is agreed up front, with EU regions as the default, as described on our deployment page. This describes our own hosting. It is not a certification, and it does not replace the processor contract and the checks above on any project. Our approach to security is set out on the security page.

Not legal advice

This article is general information from an engineering team, not legal advice. Statements about GDPR articles follow the Official Journal text of Regulation (EU) 2016/679 as published on 4 May 2016, and the EDPB opinion as published. Check the current consolidated text and your national law, and ask your data protection officer or lawyer about your own case.