Often, yes. GDPR Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to people's rights and freedoms, especially with new technologies. Agents that make or shape decisions about people, process sensitive data or work at scale usually meet that test. Screen every agent either way.
What does the rule require, in plain words?
Before starting processing that is likely to be high risk, the controller must assess its impact on the protection of personal data. Article 35 names situations where an assessment is specifically required, including systematic and extensive evaluation of people based on automated processing that leads to decisions with legal or similarly significant effects, and large-scale processing of special-category data such as health information. National data protection authorities also publish lists of processing types that need one.
In substance, the assessment must describe the processing and its purposes, assess whether it is necessary and proportionate, assess the risks to people, and set out the measures to address them. If high risk remains after those measures, the controller must consult the supervisory authority before going ahead. The UK applies the same approach under UK GDPR, overseen by the ICO.
Other markets have their own versions. Nigeria's Data Protection Act 2023 includes impact assessment expectations, covered in the Nigeria Data Protection Act and AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who does it apply to?
The controller, which is usually the organisation deploying the agent. A vendor can help with information about its platform and model provider, but cannot carry out your assessment for you, because the risks depend on your purposes, your data and your customers.
What changes when the system is an agent?
Three things make an agent's assessment different from one for a static system.
It chooses what to read and send. A form collects fixed fields. An agent decides which records to open and what to pass to a model. The assessment must describe the limits on that, per capability, and how they are enforced.
Its authority changes over time. An agent at depth 2, where a person sends every output, carries different risks from the same agent at depth 3. Widening depth, or adding a capability, may change the assessment, so the assessment should state the depth it covers.
It involves more parties. The platform, the model provider and its hosting are each part of the processing chain, with their own locations and retention terms.
How do you meet it?
| Requirement in substance | Control for an agent | Evidence it leaves |
|---|---|---|
| Describe the processing | Brief, sources, connections and depth | Assessment section linked to the agent's version |
| Necessity and proportionality | Field-level limits on what each capability reads and sends | Configuration record |
| Risks to people | Risks such as wrong decisions, data exposure, unfair outcomes | Risk table |
| Measures | Bounds, held queue, certification, record, review route for decisions | Control map |
| Consultation if high risk remains | Escalation to the authority where required | Consultation record |
| Keep it current | Reassess on new capability, wider depth or new provider | Review log |
An agent can draft parts of the assessment, as described in whether an AI agent can draft a DPIA, but the data protection officer and the process owner own its conclusions.
How does it relate to other impact assessments?
A DPIA looks at risks to people from processing their personal data. A fundamental rights impact assessment under the EU AI Act, required for certain deployers of high-risk systems, looks more broadly at rights such as non-discrimination; see what a fundamental rights impact assessment is and whether AI agents need one. The NIST AI RMF suggests impact assessment as a voluntary practice, covered in NIST AI RMF impact assessment for AI agents. Many firms run them together, with shared facts and separate conclusions.
What does that look like in practice?
Say an insurer plans an agent that reads health declarations and drafts underwriting referrals. That is special-category data, used to shape decisions about cover. The data protection officer requires a full assessment. It records that the agent reads only declared conditions and the policy schedule, sends no names to the model, holds depth 2 so underwriters decide, and that every referral is filed with its sources. It also notes that any move to depth 3 will need a new assessment first.
The wider rules picture is in our guide to AI agent regulation.
Questions people ask
Do internal agents that never see customer data need one?
If they process no personal data, GDPR does not apply to them. Staff data counts too, so an agent reading employee records is in scope.
Should we do one assessment per agent or per platform?
Usually per agent or per use, since risks depend on purpose and data. A platform-level assessment can cover shared elements such as hosting and model provider terms.
When should a DPIA be updated?
When the agent gains a capability, its depth rises, its sources change materially or it moves to a different provider or region. Review it at least at each annual data protection review.