Every prompt an AI agent sends to a model provider that contains personal data is processing under GDPR, and usually a disclosure to a processor. It may leave your systems if the purpose is lawful, the provider is contractually bound, transfers are safeguarded and the prompt holds only what the task needs. Everything else should be filtered first.
What does GDPR require of prompt data?
GDPR does not mention prompts, but every principle applies to them:
- Lawfulness (Article 6). Sending personal data to a model provider is part of the processing for whatever purpose the agent serves. It needs the same lawful basis as that purpose.
- Purpose limitation. Data collected for one purpose should not be sent for another incompatible one. A prompt built for a support query should not carry the customer's credit history.
- Data minimisation. The prompt must be adequate, relevant and limited to what is necessary.
- Integrity and confidentiality. The data must be protected in transit and at the provider.
- Processor terms. Where the provider processes on your behalf, a contract must bind it to act only on your instructions, keep data confidential, secure it, help you meet data subject rights and delete or return data at the end.
- Transfers. If the provider processes data outside the EU, the transfer rules apply.
Special category data, such as health, religion or sexual orientation, needs a further condition and extra care. Our piece on GDPR special category data and AI agents covers that.
Who is responsible?
You are, as controller. The model provider is usually your processor for the inference. If the provider uses your prompts for its own purposes, such as training its models, it may become a controller for that use, and you would need a lawful basis for disclosing data to it on those terms. Most firms avoid that by contracting for no training use and short retention.
Do not confuse this with the EU AI Act's sense of provider, which refers to whoever places an AI system or model on the market; see what a provider is under the EU AI Act. A model provider can be both your GDPR processor and an AI Act provider at once.
Why do agents send more than chatbots do?
A chatbot sends what the user typed. An agent assembles its own prompts from many sources: the system prompt, the customer record, retrieved documents, previous tool results and conversation history. Each step adds data, and none of it is reviewed by a person before it goes.
That creates three agent-specific risks:
- Context bloat. An agent retrieves a whole customer file to answer one question about an address. The full file, including unrelated sensitive details, goes in the prompt.
- Accumulation. Over a long task, the agent's context grows with every tool result. Data needed in step two is still being sent in step twenty.
- Cross-purpose leakage. An agent working several jobs carries data from one into the prompt for another, breaching purpose limitation.
The system prompt itself should contain no personal data at all; it is sent with every call and is rarely subject to the same controls as case data.
How do you filter what does not need to leave?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful basis per purpose | Each agent capability mapped to a purpose and basis | Record of processing entry |
| Purpose limitation | Retrieval scoped to the case and capability; no cross-case context | Retrieval rules; session design |
| Data minimisation | Field-level retrieval: the agent receives the fields the task needs, not whole records | Field maps per capability |
| Filter identifiers | Direct identifiers replaced with tokens before sending, re-inserted on return where needed | Tokenisation logs |
| Special category data | Detection and removal or masking unless the capability needs it and has a condition | Filter rules; exception approvals |
| Processor contract | Terms covering instructions, confidentiality, security, no training use, retention, deletion | Signed contract |
| Transfers | Safeguards in place for any processing outside the EU | Transfer assessment |
| Context limits | Context pruned between steps; history capped | Agent configuration |
Tokenisation is often the most effective single control. An agent drafting a letter needs to know there is a customer with an overdue balance and a preferred tone; it rarely needs the customer's name and account number until the final letter is assembled inside your systems.
Purpose limitation deserves its own review whenever an agent is given new sources; our piece on GDPR purpose limitation when an AI agent reuses data covers it.
What will a supervisor or auditor ask?
- What personal data do your agents send to model providers? Show us a sample prompt.
- What does your contract say about retention and training use?
- Where is the data processed?
- How do you stop special category data reaching the provider when it is not needed?
- How do you know the agent sends only what the task needs?
What does GDPR not settle about prompts?
It does not ban sending personal data to model providers; it governs how. It does not fix a retention period for the provider; your contract should. It does not resolve whether outputs returned by the model are accurate, which is a separate duty. And the question of sending personal data to a model provider in another country depends on transfer rules covered elsewhere. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is a model provider always a processor?
Usually, when it processes prompts only to return a response to you. If it uses your data for its own purposes, such as training, it may act as a controller for that use. Your contract should make the position clear.
Can we send customer names to a model provider?
You can if the purpose needs it, there is a lawful basis, and the provider is bound properly. Often the task does not need the name at the model step, and replacing it with a token is simpler.
Do we need customer consent to use a model provider?
Not usually. Consent is one lawful basis among several, and processing through a processor rarely needs its own consent. Your privacy notice should tell customers that AI services and processors are used.