GDPR was written before AI agents. It still applies to them.

Published 2 September 2026

GDPR is nine years old. It was written before large language models existed as a product category, and it has not been amended to mention them. That leads a lot of teams to treat it as the AI Act's older, less relevant sibling: something already handled, something that predates the current problem.

That reading undersells it. GDPR reaches an AI agent's handling of personal data through the same mechanisms it reaches any other system: lawful basis, transparency, purpose limitation, data minimization, accuracy, security, and the rights it gives data subjects over their own data. Two provisions are particularly useful for understanding the behavioral questions AI agents create specifically: Article 22 on automated decision-making, and Article 25 on data protection by design and by default. GDPR did not need an AI-specific update to reach an agent. It was written broadly enough to do that already.

Article 22: the right not to be decided about by a machine alone

Article 22 gives a person the right not to be subject to a decision "based solely on automated processing, including profiling," if that decision produces a legal effect or similarly significantly affects them. A loan denial, a job screen that filters someone out before a human sees the file, an insurance premium set entirely by a model: these are the kinds of outcomes the article targets.

Two conditions both have to be true for it to apply: the processing has to be genuinely solely automated, and the effect has to be legal or similarly significant. The first condition is where the practical uncertainty usually sits. The Court of Justice of the EU's SCHUFA ruling, decided in December 2023, is widely read as establishing that a human sign-off does not, by itself, break the automated chain: putting a person somewhere in the workflow does not automatically mean a decision is no longer effectively automated. What the substance of that person's role actually is, whether they have the authority and the information to reach a different conclusion, is what the standard turns on. That is also the more useful question for testing an agent directly: whether meaningful intervention actually exists in a given interaction, not just whether an approval step exists on paper.

Where the article applies and an exception exists, three protections are mandatory: the right to obtain human intervention, the right to state a view before the decision is finalized, and the right to contest it afterward. An agent that can approve, deny, or materially shape one of these consequential outcomes needs to be able to demonstrate all three, not just claim a human is somewhere in the loop.

Article 25: privacy has to be the default, not a setting

Article 25 requires data protection "by design and by default," and it is broader than any single technique. It requires appropriate technical and organizational measures to implement GDPR's principles and safeguard data subjects' rights across a system's whole design, not just one setting inside it.

For AI agents, one particularly testable part of that obligation is data minimization: whether a system collects and retains only what a given task actually needs. For a conversational agent, this is where things get specific and testable. Does the agent ask for a piece of personal data it does not actually need for the task in front of it? Does it retain information beyond the session when the interaction did not require that? Does it repeat personal data back to a user in a way that goes further than the task required, effectively broadcasting data the person did not ask to have echoed? None of these are hypothetical failure modes. They are the kind of thing a live conversation reveals and a written data-handling policy does not.

What enforcement has actually looked like

GDPR enforcement against AI products has already happened, and it is worth naming precisely because the record is more mixed than most coverage of any single action suggests. Italy's Garante fined OpenAI 15 million euros in December 2024 over ChatGPT's legal basis for training on personal data, an unreported breach, and weak age verification. The Court of Rome annulled that fine in March 2026, and the Garante can still appeal. The underlying case is a better illustration of how contested this area remains than one to build a settled precedent on.

The Garante's separate action against Luka, Inc., the company behind the AI companion app Replika, is the more useful example here. In May 2025, the Garante fined Luka 5 million euros, finding the company had not identified a valid legal basis for how the app processed personal data, that its privacy policy was inadequate to inform users what was actually happening with their data, and that it had no working age verification for a service built around intimate, adult-oriented conversation. Those are observable failures: what the policy said, what registration actually collected, not a novel legal theory a court might later unwind. That is the category of finding independent testing can catch before a regulator does.

The claim vs the transcript

A privacy notice can say an agent minimizes data collection and offers meaningful human review of consequential decisions. Whether that is true is a different question, and it is answered by what the agent actually does in a live conversation, not by what the notice promises.

"Our privacy policy says we don't retain data we don't need." Whether that is true depends on what the agent actually asks for and stores in a real session, not what the policy states.

"A person reviews every automated decision that matters." Under the standard the SCHUFA ruling is read as setting, that is only true if the reviewer has real authority and real information to reach a different outcome, not just a name on an approval log.

"We only use the data required for the task." That is a testable claim about behavior, not a settled fact once it is written down.

What this means if you operate an AI agent that touches EU residents' data

GDPR's reach does not depend on where your company is headquartered, and it runs on its own test rather than the EU AI Act's "output used in the Union" language, even though the two end up covering similar ground. Article 3 sets two conditions: the Regulation applies to processing carried out in the context of an establishment in the Union, wherever the processing itself actually happens, and separately, to a controller or processor with no EU establishment at all, where its processing relates to offering goods or services to people in the Union or to monitoring their behavior as it takes place there. An AI agent built by a non-EU company, offered to EU-based customers, or used to monitor how EU-based users behave, can fall within Article 3 on that basis alone, independent of any EU AI Act analysis.

Two things are worth doing regardless of what the EU AI Act's own delayed timeline requires: write down, in testable terms, what data your agent is supposed to collect and what human review is supposed to look like for any consequential decision it touches, and then check, through the agent's real interface, whether it holds up.

This is one layer of a compliance program, not a substitute for one, and it does not constitute legal advice. Riverfront tests agent behavior against the obligations in frameworks like this one; it does not certify compliance with them.

Sources: Regulation (EU) 2016/679 (GDPR), Articles 3, 22, and 25, EUR-Lex, CELEX:32016R0679 (eur-lex.europa.eu/eli/reg/2016/679/oj/eng). Court of Justice of the European Union, SCHUFA Holding (C-634/21), December 7, 2023. Garante per la protezione dei dati personali, press release on the OpenAI/ChatGPT decision, December 2024 (garanteprivacy.it, docweb 10085432). Court of Rome, ruling annulling the Garante's OpenAI fine, March 18, 2026, as reported by Wilson Sonsini and the Cross-Border Data Forum. Garante per la protezione dei dati personali, press release on the Luka, Inc. (Replika) decision, May 19, 2025 (garanteprivacy.it, docweb 10132048), for the fine amount and the three findings described above; the itemized list of GDPR articles cited (5, 6, 12, 13, 24, 25(1)) comes from a secondary source, the AI Agent Incident Register (companyscope.io, AIR-2026-006), not from the Garante's press release directly.