Can an AI agent maintain a record of processing activities?

Yes, and it fixes the main weakness of most records: they go stale. An AI agent can watch for new systems, vendors, data fields and agents, draft or update entries, and flag ones nobody has reviewed. Choosing the purpose and lawful basis, and approving each entry, stay with the privacy lead or data protection officer.

Why do records of processing go out of date?

GDPR Article 30, and the UK equivalent, require most organisations to keep a record of their processing activities: in substance, the purposes, the categories of people and data, the recipients, any international transfers, retention periods and a general description of security measures. Supervisors can ask to see it.

Most records are built in one big exercise, often before a deadline or an audit, and then decay. A new marketing tool is bought. A product adds a field. A team starts exporting data to a spreadsheet. Each change should touch the record, and almost none do, because nobody is watching for them. An agent can watch.

What may the agent prepare?

The agent may:

• Watch for change signals: new vendor contracts, new systems in the asset inventory, schema changes, new integrations, new agents deployed, and new forms collecting data.
• Draft a new entry or an update, filling the fields it can evidence: data categories, systems, recipients, transfer locations and retention rule.
• Flag fields it cannot evidence, such as purpose or lawful basis, for a person to complete.
• Cross-check the record against contracts and the vendor list, and flag processors with no entry.
• Flag entries past their review date or whose owner has left.
• Check new processing against your screening criteria and recommend whether a DPIA is needed; see how to run DPIA screening for new processing with an AI agent.

The privacy lead decides:

• The purpose of each processing activity and its lawful basis.
• Whether a new use is compatible with the original purpose.
• Retention periods, where policy does not already set them.
• Approval of each entry and update.
• Whether a DPIA is required.

Are the agents themselves processing activities?

Yes, and this is where many records fall short. An AI agent that reads customer data to answer a query, or drafts a letter, is processing personal data. Its purpose, data, recipients (including any model provider acting as processor) and retention of its own records belong in the record of processing.

An agent maintaining the record can catch this. When a new agent is deployed, the deployment itself is a change signal. The maintaining agent drafts an entry: the deployed agent's role, the sources it reads, the data categories in those sources, where its outputs go and how long its verdict record is kept. The privacy lead completes the purpose and basis. Records of what agents found and did not find are useful evidence here too; see compliance agents must record what they did not find.

What does an update look like?

Take a mid-sized insurer. Procurement signs a contract with a new claims photo assessment service. The agent sees the new contract in the vendor system.

It drafts an update to the "claims handling" entry: a new processor, image data of damaged property that may include people and vehicle registrations, transfer to the processor's hosting location, and retention following the claims file. It flags that the contract does not state the processor's retention period and that the images may contain data about third parties, such as other drivers. It recommends DPIA screening because images of people are involved.

The privacy lead confirms the purpose sits within the existing claims purpose, asks procurement to add a retention clause, and runs the screening. The entry is approved with the open point recorded. The record now reflects the change within days of the contract, rather than at the next annual review.

Which controls keep the record reliable?

• Change signals are defined. The agent watches a known list of sources, and the record notes which sources it watches.
• Evidence for each field. Every entry field links to the contract, system or document it came from.
• Unfilled fields stay visible. Purpose and lawful basis are never guessed.
• Approval recorded. Each version of an entry shows who approved it and when.
• Linked to the obligations register. The record of processing sits alongside the firm's wider obligations; see how to maintain the regulatory obligations register with an AI agent.

The broader principle is in AI compliance agents: second line, never the last word.