Keep enough to reconstruct each decision and no more. Log references to personal data rather than copies where you can, pseudonymise what must be stored, keep full conversation text in a separate, tightly controlled store, set retention by purpose, and make the logs searchable so you can answer access requests. Agent logs are personal data processing, and data protection law applies to them in full.
Why are agent logs a particular problem?
An agent's record has two jobs that pull in opposite directions. It must be complete enough to show why each action was allowed, which auditors, regulators and the EU AI Act's record-keeping expectations all lean on. It also contains whatever the agent read: names, account numbers, health details mentioned in a complaint, a customer's description of a bereavement.
Logs built for engineers tend to capture everything, including full prompts and model outputs, and keep it indefinitely in a system many people can read. That is the opposite of data minimisation under GDPR Article 5.
What are the practical steps?
- Separate the decision record from the conversation text. The decision record holds the verdict, the bound that decided, the action and references to the facts used. The full text sits in a second store with narrower access and shorter retention.
- Reference, don't copy. Where a fact comes from a system of record, log its identifier and version rather than its content. The fact can be retrieved later if needed.
- Pseudonymise in the operational logs. Engineers debugging the agent see tokens, not names.
- Classify as you log. Mark records that contain special-category data, such as health information, so they get stricter handling. An agent can help; see whether an AI agent can classify personal data.
- Redact where text must be kept. Remove details the record does not need, such as card numbers pasted into a chat; see whether an AI agent can redact personal data from documents.
- Set retention by purpose. Decision records as long as decisions can be challenged; conversation text for less; debugging logs for days or weeks.
- Restrict access by role, and log who reads the logs.
- Keep logs searchable by person, so you can find everything about one individual when asked.
How do the rules apply?
Under GDPR, and UK GDPR with the Data Protection Act 2018, agent logs need a lawful basis (Article 6), must follow the Article 5 principles including minimisation and storage limitation, and belong in your records of processing under Article 30. A data protection impact assessment under Article 35 is likely where agents process personal data at scale. In the UK, our article on ICO expectations for AI agents processing personal data covers the regulator's view. People can ask for their data, and that includes what sits in agent logs; see GDPR data subject access requests and AI agent logs.
The EU AI Act's Article 12 requires high-risk AI systems to keep automatic logs. That does not override data protection; it means the record must be designed to satisfy both. Our guide on keeping automatic logs for an AI agent covers the logging side.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What may the agent do, and what stays with a person?
| Task | The agent | A person |
|---|---|---|
| Tag records containing personal or special-category data | Tags as it logs | Reviews the tagging rules |
| Redact unnecessary details from stored text | Redacts by rule | Samples the results |
| Find a person's data for an access request | Searches and assembles | Reviews and decides what to disclose |
| Delete at end of retention | Nothing; deletion is automated by rule | Approves the rule and exceptions |
| Disclose logs to third parties | Nothing | Data protection officer decides |
A worked example
Take an insurer's claims agent. A customer writes that the claim is delayed because she has been in hospital with a heart condition. The agent logs a reference to the message in the claims system, tags the record as containing health data, and records its verdict: claim update drafted, held for a handler. The operational log shows a token instead of her name. The full message text sits in the restricted store for the claim's retention period.
Six months later she asks for her data. The privacy team searches by her identifier, finds the verdicts and the message, reviews them, and discloses what she is entitled to.
Which controls make the answer hold?
- Two stores, two access levels.
- References over copies.
- Retention set per store and enforced automatically.
- Special-category tagging.
- Access to logs logged.
The topic guide, agent governance is a bound, not a model, explains why the record is central to governance and must still respect privacy.
Questions people ask
Can we keep full prompts for model improvement?
Only with a lawful basis for that purpose and clear limits. We never update model weights for a customer, so in a governed design there is less reason to keep full prompts long term.
Do logs need to be encrypted?
Yes, at rest and in transit, with keys managed separately from the log store.
What about personal data sent to the model provider?
Treat the provider as a processor, with a contract, and limit what is sent to what the task needs. Record the flow in your records of processing.