AI agents and GDPR: seven questions to ask before your company starts
A practical checklist for EU companies choosing an AI agent platform, covering where data is processed, model training, access, human approval, records, agreements and deletion.
AI agents are different from a chat window. They work with company files, connect to company tools and can take actions such as sending an email or publishing a page. That’s what makes them useful, and it’s why an EU company should ask a few questions before it lets agents near personal data.
This checklist is a starting point for those conversations, not legal advice. For each question, we say how Outclank answers it.
1. Where is the data stored and processed?
Ask for a list of every provider that processes your data, what each one does and where. “In the cloud” is not an answer.
In Outclank: the website and the app run their core workspace infrastructure (hosting, database, sign-in and file storage) in EU regions. AI requests go to model providers, and where they’re processed depends on the enabled provider and route, so there is no blanket EU-only guarantee for AI processing. Every provider and where it processes data is listed on the subprocessors page.
2. Do the AI providers train their models on our data?
This is the question behind most worries about AI at work. Consumer AI accounts often allow training on what users type. A business platform should rule it out in its agreements with the providers.
In Outclank: under our agreements with them, the AI providers do not use your data to train their models. A provider may keep a request for a short time, as its terms allow, to detect abuse.
3. What can an agent actually reach?
An agent should have exactly the access its work needs and no more: specific tools, specific information, specific actions. Connecting one person’s account shouldn’t quietly connect everyone’s.
In Outclank: agents act only within the access a company grants them, the available actions and the company’s approval policy. Company admins set up connections and decide which tools an agent can use, which information it can access and what work it can carry out.
4. Who decides what gets used?
GDPR pays particular attention to decisions made solely by automated processing. More practically, unchecked AI output is how mistakes reach customers.
In Outclank: agents carry out the work, independent QA checks the result against the brief, and an authorized person accepts the result or requests changes. Actions such as publishing or sending can require approval before they happen. Read more in Delegate, review, accept.
5. Is there a record of what happened?
When someone asks what data was used, or why a message went out, you need to be able to answer. Look for a record of the brief, the files, the questions, the checks and the decision.
In Outclank: the brief, questions, files, checks and the acceptance decision stay together with the work, so every step is on record.
6. Is there a data processing agreement?
When a provider processes personal data on your company’s behalf, GDPR Article 28 requires a contract that sets out how. Your company remains the controller of the data it puts into the workspace.
In Outclank: for the content a company puts into its workspace, the company is the controller and Humanodoro processes it on the company’s behalf. On request, we conclude a data processing agreement under Article 28 of the GDPR. Our own providers process data only on our instructions and under data processing agreements.
7. What happens to the data when we leave?
Ask how long data is kept, when it’s deleted, and what happens to backups.
In Outclank: workspace data is kept for the duration of the contract and deleted within 90 days after it ends, unless the company asks earlier or the law requires longer. Backups are overwritten within a further 30 days. The full retention table is in the privacy policy.
The short version
Before agents touch company data, you should know where it goes, that it isn’t used for training, what agents can reach, who approves their work, where the record is, what the agreement says and when the data is deleted. If a provider can’t answer one of these clearly, that’s your answer.
Questions about your own setup? Write to info@humanodoro.com.