Yes, as a first pass a person checks. An AI agent can scan systems and documents, find personal data, tag its category and propose entries for the records of processing. It handles volume and free text well. Ambiguous cases, special-category data, lawful basis and anything feeding a breach decision stay with the data protection officer or their team.
Why classify personal data at all?
Because almost every data protection duty depends on knowing what you hold. Under GDPR and UK GDPR, the Article 5 principles, the Article 30 records of processing, the Article 35 data protection impact assessment and breach assessments all start with the question: what personal data is here, and what kind?
In most firms the answer is "more than we think, in more places than we think". Personal data sits in free-text notes, email attachments, spreadsheet exports and logs. Finding it by hand is slow and patchy.
What may the agent do, and what stays with a person?
| Task | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Discovery | Scans named systems and folders for personal data | 1 | Approving which systems are scanned |
| Tagging | Labels fields and documents by category, such as contact, financial, health | 2 | Confirming tags on ambiguous items |
| Special-category flags | Highlights possible health, biometric or similar data | 2 | Deciding whether it is special-category |
| Inventory | Drafts entries for the records of processing | 2 | Approving entries |
| Lawful basis | Notes the basis already recorded for similar data | 1 | Deciding the lawful basis |
| Retention links | Matches data to retention schedules | 2 | Resolving data with no matching schedule |
| Exceptions | Lists data it could not classify | 2 | Deciding each one |
The agent proposes; the data protection team decides. That is the pattern across compliance work.
Where does classification go wrong?
Free text. A complaint note saying "customer explained she missed payments while in hospital" contains health data. Field-based tools miss it. An agent reading the text can catch it, but it can also miss subtler cases, so free text needs targeted testing.
Indirect identifiers. Data that is not a name or number can still identify someone in context: a job title in a small team, a rare postcode with a date of birth. The agent should flag combinations, not just individual fields.
Pseudonymised data. Data with names replaced is still personal data if the firm can re-identify it. An agent that marks pseudonymised data as "not personal" is wrong.
Over-classification. Tagging everything as sensitive feels safe, but it makes the inventory useless and slows legitimate work. Test for this too.
Does the agent's own processing need care?
Yes. To classify personal data, the agent reads it. That is processing in its own right, so the firm should limit what the agent retains, keep its working outputs within the firm's systems, and make sure its logs do not become a new store of the data it found. Practical steps are in how to handle personal data in AI agent logs.
An illustrative example
Take a retail bank preparing to migrate a legacy complaints system. The data protection team asks the agent to classify what the old system holds.
The agent scans the database fields and a sample of attached documents. It tags names, addresses and account numbers as expected. In the free-text notes it finds references to illnesses, bereavements and, in a few cases, criminal proceedings, and flags each as possible special-category or criminal offence data. It also finds a folder of call recording transcripts that no one had listed. It drafts inventory entries and a list of items it could not classify, such as scanned letters in poor quality.
The data protection officer confirms most tags, reclassifies a few, and decides the transcripts need their own retention review. She records the lawful basis for each category herself.
How does this connect to breach work?
Classification is the input to breach assessment. When personal data is exposed, the first questions are what kind and about how many people. A good inventory answers them quickly. The agent can help assess a breach, as covered in how to assess personal data breaches for notification with an AI agent, and the personal data breach assessment template gives a structure. Whether to notify is still a person's decision.
Redaction is the natural next step after classification; see whether an AI agent can redact personal data from documents.
What controls keep it safe?
- Scope approved in advance: which systems the agent may scan.
- Classification rules tested on a sample the team has already classified.
- Special-category flags always reviewed by a person.
- No onward use of what the agent finds beyond the classification task.
- A record of every classification decision and who confirmed it.
The agent itself should be classified by risk too, since it handles sensitive data; see how to classify AI agents by risk. The wider principle is in AI compliance agents: second line, never the last word.
Questions people ask
Can the agent classify data in real time as it is created?
It can tag new records as they arrive, which keeps the inventory current. Tags on sensitive categories should still be reviewed on a schedule.
Is an agent better than pattern-matching tools?
For structured fields, pattern matching is reliable and cheaper. For free text and documents, an agent catches more. Many firms use both.
Does classification by an agent need a DPIA?
Possibly. If the scan covers large volumes of sensitive data, assess the processing as you would any other high-risk activity.