No. Whether a personal data breach must be reported turns on a fast judgement, on incomplete facts, about risk to the people affected, and someone must answer for it. An AI agent can gather the facts, work out what data and how many people are involved, track the deadline and draft the notice. The data protection officer decides.
What is the decision?
Under GDPR and UK GDPR, a controller must notify the data protection authority of a personal data breach without undue delay, within a short deadline, unless the breach is unlikely to result in a risk to people's rights and freedoms. Where the risk is high, the affected individuals must be told too. Every breach, notified or not, must be recorded.
So the decision has three parts: is it a personal data breach at all; what is the likely risk to individuals; and does that risk cross the line for telling the authority, the individuals, or both? Each involves judgement about consequences such as fraud, distress, discrimination or loss of confidentiality.
What may the agent do, and what stays with a person?
| Task | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Intake | Records the report, time discovered, who reported | 3 | Nothing |
| Facts | Gathers what happened, which systems, when it started and stopped | 1 | Confirming the facts |
| Scope | Identifies data categories and counts individuals from the firm's inventory | 1 to 2 | Accepting the scope |
| Risk factors | Lists factors that raise or lower risk, such as encryption, special-category data, recipient | 2 | Weighing them |
| Deadline | Tracks the notification clock from discovery | 3 | Nothing |
| Decision | Never | None | Whether to notify the authority and individuals |
| Drafting | Drafts the notice to the authority and to individuals | 2 | Approving and sending |
| Record | Writes the breach record, including decisions not to notify and why | 2 | Signing the record |
A structured form for this is the personal data breach assessment template.
Why can the agent not make the call?
Because the inputs are uncertain and the consequences are asymmetric. Early in a breach, nobody knows exactly what was taken or by whom. A judgement has to be made anyway, and it has to be defensible later. Notifying when unsure is usually safer than not, but over-notifying has costs too, including alarming customers needlessly.
That trade-off belongs to someone accountable. The wider argument, that detection can scale but decisions must stay with people, is made in surveillance agents can find more; people must decide more.
What should the agent record that people often forget?
What it did not find. If the agent searched access logs for signs of data being copied and found none, that absence matters to the risk judgement and to any later review. If it could not search a system because logs were unavailable, that matters even more. The point is made in compliance agents must record what they did not find.
An illustrative example
Take an insurer whose staff member emails a spreadsheet to the wrong external address. The spreadsheet holds names, policy numbers and claim details for several hundred customers, some with health information.
The agent logs the report and starts the clock. It identifies the data categories from the file, counts the individuals, and notes that health data is special-category. It checks whether the file was encrypted (it was not) and whether the recipient is known (a broker's general inbox). It lists risk factors on both sides: the recipient is a regulated firm likely to delete it on request, but health data raises the stakes. It drafts a notice to the authority and a letter to affected customers.
The data protection officer reviews, has the broker confirm deletion in writing, and decides to notify the authority because of the health data, but not to write to individuals, recording why the risk to them is not high. Her reasons go in the breach record.
How does this relate to other breach reporting?
Personal data breaches are one kind of reportable event. Firms may also have to report rule breaches to their conduct regulator, and, under DORA or NIS2, significant ICT incidents to the relevant authority. One event can trigger several. The rule breach question is covered in whether an AI agent can decide whether to report a rule breach to a regulator, and keeping the overall record in whether an AI agent can keep a compliance breach log.
What controls make it safe?
- No notification capability. The agent cannot submit to the authority or send to customers.
- Deadline alerts that escalate before the clock runs out.
- Scope drawn from the firm's data inventory, not guessed.
- Every decision, including not to notify, recorded with a name and reasons.
- Tested on past breaches with known decisions before use.
The principle for all compliance agents is in AI compliance agents: second line, never the last word.
Questions people ask
Can the agent decide that something is not a breach at all?
It can propose that, with reasons. A person should confirm, because a wrong "not a breach" means nothing is recorded or assessed.
What if the data protection officer is unavailable?
The firm should have a named deputy. The agent can escalate to them automatically when the deadline approaches.
Should the agent assess breaches by processors too?
Yes, once the processor reports them. The firm, as controller, still decides on notification.