Tell customers plainly which jobs AI agents do with their data, what data each agent uses, why, who else receives it, how long it is kept, and whether any agent makes decisions about them. GDPR transparency requires this in clear language, at the point of collection, and it belongs near the top of your privacy notice, not in an appendix.
What does GDPR transparency require?
Article 5 requires processing to be lawful, fair and transparent. GDPR then sets out the information people must receive, in substance:
- who the controller is and how to contact them;
- the purposes of processing and the lawful basis for each;
- legitimate interests relied on, where relevant;
- recipients or categories of recipients, including processors;
- international transfers and the safeguards used;
- retention periods or the criteria for them;
- the person's rights;
- the existence of automated decision-making, including profiling, with meaningful information about the logic, significance and envisaged consequences.
Information must be concise, intelligible, easily accessible and in clear and plain language. It must be given when data is collected from the person, or within a reasonable time when it is obtained from elsewhere.
Who does it apply to?
Every controller under GDPR or UK GDPR. If your agent platform is a processor, your notice must still cover what the agent does, because the processing is yours. Platforms acting as controllers for their own purposes need their own notices.
What do agents change about privacy notices?
Most notices were written for systems that store and process data in fixed ways. Agents need three additions.
Purposes by job, not by technology. "We use artificial intelligence to improve our services" says nothing. "An AI agent reads your messages to our support team, finds your account details and drafts a reply that a team member checks" says what happens. Describe agents by the job they do.
Sources the agent reads. An agent may combine your account records, past complaints and call notes to handle one request. People should know the categories of data the agent can draw on, especially if it includes data collected for another reason.
Decisions and their effect. If an agent can approve, decline, block or close anything without a person, say so, say what it considers, and say how to reach a person.
Do not confuse this with the separate EU AI Act duty to tell people they are dealing with an AI system at the moment they interact with it. That is covered in Article 50 transparency for AI agents. The two duties meet different needs: one is a disclosure in the conversation, the other is the record of what happens to the data.
How do you update the notice without burying the point?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Purposes and lawful basis | One short entry per agent job: what it does, with which data, on which basis | Notice section; records of processing that match |
| Recipients | Agent platform and model provider named as categories of processors | Notice text; processor register |
| Transfers | Where agent processing happens outside your jurisdiction and under what safeguard | Transfer assessments |
| Retention | Periods for conversation history and agent memory, not just for "records" | Retention schedule linked from notice |
| Automated decisions | Each decision type described with its logic, effect and how to challenge | Logic statements; decision templates |
| Plain language | Tested with people outside legal and compliance | Readability review notes |
| Kept current | Notice reviewed whenever an agent gains a new job or data source | Change log tied to agent changes |
A layered notice works well. The top layer, a few sentences, says that AI agents help handle certain requests, what they do, and that a person is available. The next layer gives one paragraph per agent job. The full detail sits below. Our explainer on what AI transparency means sets out why this layering matches how people read.
Keep the notice honest about limits. If the agent cannot use special category data or does not decide anything, say that too; it reassures and it is evidence.
What should a notice entry for an agent look like?
An illustrative entry: "Payment support agent. When you contact us about a missed payment, an AI agent reads your account history and recent messages to prepare a repayment plan. It does not see your other products. A member of our collections team reviews and sends every plan. We keep the conversation for the life of the plan plus the period set out in our retention schedule. Our lawful basis is performance of your contract."
That entry tells the reader the job, the data, the boundary, the human role, the retention and the basis in under a hundred words. Its boundary statement also forces discipline, because it must remain true; our guide to GDPR data minimisation for AI agents covers how to keep the agent within it.
What will a supervisor or auditor ask?
- Does the notice describe each agent job, or only AI in general?
- Do the descriptions match what the agents can actually access and do?
- When did an agent last gain a new data source, and was the notice updated first?
- Where do you describe automated decisions, and how does a person challenge one?
- Who outside your legal team has read the notice and understood it?
What does the transparency duty not cover?
It does not require consent; it requires information. It does not oblige you to disclose security details or trade secrets. It does not replace the in-conversation disclosure under the EU AI Act, or sector disclosure rules in financial services. For how the rules connect, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Do we need to name the AI model or the vendor in the notice?
GDPR requires recipients or categories of recipients. Many firms give categories, such as "our AI agent platform provider and the model provider it uses". Some regulators prefer names where practical, so keep a list ready for access requests.
Is a banner in the chat window enough?
No. A banner can meet the in-conversation disclosure, but it does not carry the purposes, basis, retention and rights that GDPR requires. Link the banner to the relevant section of the notice.
How often should the notice change as agents evolve?
Whenever an agent gains a new purpose, a new data source or a new decision. Tie the notice review to your change process for agent briefs, so it cannot be skipped.