Read this first
This page is practical guidance, not legal advice — the specifics depend on your role (controller vs processor), your location, and what the agent processes. Ask your counsel before treating any checklist as sufficient.
Why agents are special under GDPR
An agent reads, writes and logs by itself. That means the data protection questions arrive automatically: what did it collect, where did it store it, who can see it, and can you delete it on request? The answers have to come from the system, not from memory — which is exactly what an audit trail provides.
The practical checklist
- Minimize: give the agent access to the folders it needs, nothing more — file path rules do this.
- Know your flows: map where agent outputs land and who can read them.
- Honor access requests: exports must be pull-able on demand via the audit export.
- Honor deletion: what the agent writes must be deletable; keep a retention rule for logs.
- Document the controls: the policy, the logs, and the review cadence — the artifacts in central policy.
The evidence question
Regulators ask “show me”, not “tell me”. A signed, append-only audit chain turns “we believe the agent only touched X” into “here is every step, verified” — the same mechanism covered in audit compliance.
Data residency is the sibling problem
Where the model calls go matters for GDPR too — see data residency for the provider-side questions.