Three questions decide every law enforcement request: is it genuine, what is its legal basis, and what exactly does it ask for. The agent prepares answers to the first and third and gathers the records; legal answers the second and decides what is released. A person sends every response, and the request is logged out of the customer's sight.
What is the process, and who owns it?
Police forces, tax authorities and other investigating bodies ask firms for customer information. Some requests are compulsory, backed by a court order or a statutory power, and must be complied with by a deadline. Others are voluntary, relying on data protection exemptions for preventing or detecting crime, and the firm must decide whether disclosure is justified and proportionate. Getting this wrong either way is costly: refusing a valid order is contempt or an offence; disclosing on a weak voluntary request can be unlawful processing.
A disclosures team, often in legal or financial crime, owns responses. Requests linked to suspicious activity reporting may route to the nominated officer; see responding to financial intelligence unit requests. Whether an AI agent can respond to a law enforcement request sets the overall boundary.
What are the steps?
- Person, disclosures team: logs the request in a restricted case area. Requests that arrive elsewhere, such as at a branch or through customer service, are forwarded without being discussed.
- Agent, depth 1: checks authenticity. Sender, channel, reference format and requesting officer against your register of known authorities. Unknown or unusual requests are verified by a person through an independent contact route.
- Agent, depth 1: classifies the request. Compulsory, with the order or power cited, or voluntary. It extracts the stated legal basis, the subjects, the period, the information sought and the deadline.
- Agent, depth 1: identifies the subjects in your systems, with exact and possible matches listed separately.
- Agent, depth 2: drafts a scoping note. What the request covers, what records exist, anything ambiguous, and any personal data of third parties that would be caught.
- Person, legal or disclosures lead: decides. For compulsory requests, confirms validity and scope. For voluntary requests, decides whether disclosure is justified and proportionate, and what to release.
- Agent, depth 1: gathers the approved records and prepares them in the format required.
- Agent, depth 2: drafts the covering response and the disclosure record.
- Person, disclosures team: reviews and sends through a secure channel.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Log | Nothing | None | Logging and restricting |
| Authenticity | Checks against known authorities | 1 | Independent verification |
| Classify | Extracts basis, scope, deadline | 1 | None |
| Subjects | Matches identifiers | 1 | Confirming matches |
| Scope note | Drafts coverage and issues | 2 | Legal basis decision |
| Gather | Collects approved records | 1 | None |
| Draft | Letter and disclosure record | 2 | Approving |
| Send | Nothing | None | Disclosures team |
Which controls apply, and what evidence does each leave?
Authenticity checked independently. Fraudulent requests impersonating police are a known way of obtaining customer data. Evidence: verification method and result on each request.
Legal basis recorded. Every disclosure records the basis relied on: the order, the statutory power, or the exemption and the reasoning for a voluntary disclosure. Evidence: the disclosure record, which is what the data protection regulator would ask to see.
Disclosure minimised. Only what is asked for and justified, with third-party data removed unless required. Evidence: the scoping note and the list of records released.
Customer not notified. A subject asking for their data later may be entitled to know about disclosures in some circumstances and not others. The disclosures team decides. Where a customer submits an access request, it follows handling subject access requests, with the restricted case flagged to the privacy team.
Deadline tracked. Evidence: received, due and sent dates.
What should you measure?
- Compulsory requests answered by their deadline.
- Requests that failed authenticity checks.
- Voluntary requests declined, and the reasons, which show the team is exercising judgement.
- Disclosure errors, such as wrong customer or excess data.
- Turnaround time from receipt to response.
- Requests received outside the restricted route, such as at branches or through customer service, which shows where staff training is needed.
Where does it usually go wrong?
Front-line staff respond directly. An officer calls a branch and a well-meaning employee reads out account details. Training and a clear routing rule prevent this; the agent can spot such requests in contact records and route them.
Voluntary treated as compulsory. A polite letter citing a data protection exemption is not an order. The firm must make its own decision, and record why disclosure was or was not justified for that request.
Possible matches disclosed. A customer with a similar name is not the subject. Disclose only confirmed matches, and record how each match was confirmed.
Requests that are really regulator requests. Supervisory requests follow a different process with different rules. See whether an agent can answer regulator information requests.
Local law ignored. Disclosure rules vary. In the DIFC, for example, the DIFC Data Protection Law governs when personal data may be shared; group procedures need local variants.
Agent records overlooked. If AI agents dealt with the customer, their conversation records and decision logs may fall within an order's scope. The scoping note should list them alongside statements and correspondence, so legal can decide whether they are caught.
The overall stance on compliance agents is in AI compliance agents.
Questions people ask
Can the agent decide whether a voluntary request is justified?
No. That is a legal judgement balancing the person's rights against the purpose of the request. The agent sets out the facts; a person decides.
Should the agent keep a register of authorities?
It should read one maintained by the disclosures team, with known contacts and channels. Adding a new authority to the register is a person's decision.
What if the request is urgent, such as a risk to life?
Emergency requests need a fast route with a named person on call. The agent can prioritise and prepare, but the decision to disclose in an emergency stays with that person.