Personal data that an AI agent sends outside the EU, or makes accessible from outside it, is an international transfer under GDPR. On global platforms that happens through model inference in another region, sub-processors, tool calls, log replication and support access. Each transfer needs an adequacy finding, approved safeguards, or a narrow derogation.
What does GDPR require for transfers?
GDPR restricts transfers of personal data to countries outside the European Economic Area, and to international organisations, so that the protection the data enjoys is not undermined. In substance, a transfer is allowed only on one of these grounds:
- Adequacy. The European Commission has decided that the destination country, territory or sector ensures an adequate level of protection. Data can then flow as if within the EU.
- Appropriate safeguards. Without adequacy, the exporter puts in place safeguards that give people enforceable rights and effective remedies. The usual tools are standard contract clauses approved by the Commission and, within groups, binding corporate rules approved by a supervisory authority. Regulators and courts expect the exporter to assess whether the destination's law and practice let the safeguards work, and to add supplementary measures where they do not.
- Derogations for specific situations. Narrow exceptions, such as the person's explicit consent after being told of the risks, or necessity for a contract with them. These suit occasional transfers, not the routine, systematic flows an agent creates.
Onward transfers, from the first recipient to another country, must meet the same standard.
Who carries the duty?
The exporter: the controller, and a processor where it sends data on to sub-processors. A firm deploying agents on a global platform is responsible for the transfers its agents' processing causes, even if the platform arranges them. The platform, as processor, must only transfer on documented instructions and must flow down the safeguards to its sub-processors.
Where do agents create transfers?
Agents create more transfer paths than most systems, and several are not obvious:
- Model inference. Every prompt containing personal data that is processed in a data centre outside the EU is a transfer.
- Failover and load balancing. A platform that routes inference to another region when one is busy may transfer data without anyone noticing.
- Tool calls. An agent calling an address lookup, translation, identity or payment service hosted outside the EU sends data there.
- Logs and memory. Action records and memory replicated globally for resilience are transfers.
- Support access. Engineers in another country who can view customer data in logs to debug an agent create a transfer by remote access.
- Evaluation. Real cases used to test and certify agents, if processed abroad, are transfers.
The common thread is that transfers follow configuration, not intention. Nobody decides to send a customer's data to another continent; a default region, a failover rule or a new tool does it for them. That is why the map below starts from how the agent actually runs, not from the contract.
Firms in financial services also face location and concentration questions under operational resilience rules. DORA's third-party requirements expect exit planning for critical ICT providers, which often turns on where data sits; see DORA exit strategies for AI agent platforms. Similar expectations apply in other markets, such as APRA CPS 230 for service providers and AI agent platforms in Australia.
How do you put the safeguards in place?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Know every transfer path | Data flow map for each agent: inference region, failover, tools, logs, memory, support access | Data flow map, versioned |
| Valid ground per path | Adequacy, approved clauses or binding corporate rules recorded for each destination | Transfer register |
| Assess the destination | Assessment of destination law and practice where relying on safeguards | Transfer assessment per destination |
| Supplementary measures | Encryption with keys held in the EU; tokenisation of identifiers before prompts leave | Key management records; tokenisation logs |
| Pin regions | Inference and storage pinned to approved regions; failover outside them disabled or covered | Platform configuration; region logs |
| Control tool calls | Agent may call only tools with approved locations and contracts | Tool allow-list; refusal records |
| Control support access | Remote access from abroad logged and covered by safeguards | Access logs |
| Flow down to sub-processors | Processor contract requires equivalent safeguards and notice of new sub-processors | Contracts; sub-processor list |
| Tell people | Privacy information covers transfers and safeguards | Privacy notice |
Tokenisation is the measure that changes most. If identifiers are replaced with tokens before a prompt leaves the EU, and re-inserted only inside your systems, what crosses the border may no longer identify anyone to the recipient. That reduces the risk the transfer assessment must address, though the data remains personal data for you.
Cybersecurity regimes add their own expectations of platforms; whether NIS2 applies to AI agent platforms covers the EU one.
What will a supervisor or auditor ask?
- Where is personal data processed when your agents run? Every place, including failover?
- What is the transfer ground for each destination?
- Show us the transfer assessment for the model provider's location.
- What supplementary measures protect the data?
- Who can access agent logs from outside the EU?
What do the transfer rules not cover?
They do not apply to data that never leaves the EU and is not accessible from outside it. They do not regulate data that is truly anonymised. They do not replace security duties, which apply wherever data is processed. And they do not answer the operational question of whether a platform outside your jurisdiction is a concentration risk; sector rules do. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is sending a prompt to a model in another country a transfer?
Yes, if the prompt contains personal data and the processing happens outside the EU. It needs a transfer ground like any other transfer.
Does remote access by support staff count as a transfer?
Making personal data accessible to someone in another country is treated as a transfer. Log it, limit it, and cover it with safeguards.
Can we rely on the platform's transfer arrangements?
You can use them, but you remain responsible as exporter. Review the platform's transfer register, sub-processor list and assessments, and make sure they cover how your agents actually run.