Most privacy laws were written around a relatively understandable model of computing.
A company decides what information it wants to collect. It identifies why it needs the information. It tells the individual what it intends to do. Software then performs the processing the organization designed.
Agentic artificial intelligence complicates nearly every part of that model.
An AI agent can receive a broad objective, determine which steps are necessary to accomplish it, select tools, retrieve information, call external services, change its approach when it encounters an obstacle and use what it learns along the way to determine what to do next.
The unpredictability is not necessarily a defect.
It is part of the product.
That creates a basic tension with privacy regimes such as the EU General Data Protection Regulation, which expects organizations to define purposes, identify legal bases, limit data collection and explain processing with enough specificity for individuals to understand what is happening.
In a recent IAPP analysis, Kyushu University Professor Mark Fenwick, Vinted Senior IP Counsel Paulius Jurcys and University of Copenhagen Professor Timo Minssen argue that agentic AI exposes a deeper mismatch between autonomous systems and traditional data protection law. Their argument focuses particularly on two assumptions: that organizations can determine the purpose of processing in advance and that personal data can be meaningfully separated from nonpersonal data.
The interesting question is not whether privacy law suddenly stops applying to AI agents. It does not.
The harder question is whether laws designed around predictable data flows can govern systems whose defining feature is the ability to create new data flows while they are operating.
What Makes Agentic AI Different?
Generative AI and agentic AI are related, but they are not identical.
A traditional chatbot generally waits for a prompt and produces a response.
An agent can be given an objective.
“Research these 50 companies and identify likely acquisition targets.”
“Find the best candidates for these open positions.”
“Investigate why sales declined in this region.”
“Resolve this customer’s account problem.”
The system can then decide how to accomplish the task.
It might search databases, browse the web, examine documents, query APIs, compare records, create intermediate files and invoke other software tools.
If one approach fails, it can try another.
That autonomy is what makes agents potentially useful for complex work. It is also what makes them awkward for privacy systems built around predetermined processing activities.
The GDPR Wants a Purpose Before the Processing Starts
Purpose limitation sits near the center of European data protection law.
Article 5 of the GDPR requires personal data to be collected for “specified, explicit and legitimate purposes” and prohibits incompatible further processing. The same article requires data minimization: organizations should process only information that is adequate, relevant and necessary for those purposes.
Those requirements make intuitive sense when software behaves predictably.
Consider an ordinary payroll system.
The company knows why it collects an employee’s bank account number. It knows which application will process it. It knows that the information is needed to pay the employee. It can generally identify where the information will go and how long it needs to be retained.
Now consider an agent instructed to:
“Analyze why this employee’s performance has declined and recommend whether intervention is necessary.”
Depending on its permissions, the agent might examine productivity information, calendar records, emails, attendance, previous reviews and internal communications.
It might then discover references to medical treatment, family problems or another category of sensitive information.
No developer necessarily wrote a rule instructing it to look for that information.
The agent decided that the information was relevant to its objective.
That is where the traditional model becomes strained.
An Agent’s Objective Is Not the Same Thing as Its Processing Purpose
The original IAPP article makes this point through autonomous web research.
An old-fashioned scraper follows predetermined instructions: visit these pages, extract these fields and save the results.
An agent might instead receive a request such as “map regional market sentiment.”
To accomplish that objective, it could decide to search mainstream news, social platforms, discussion boards, reviews or obscure forums. It could encounter usernames, photographs, employment histories, political opinions or other personal information that nobody specifically expected it to retrieve.
Its path develops during execution.
This creates an important distinction.
The company may know the business objective.
It may not know every processing operation the agent will decide is useful in achieving it.
Saying “we process data to conduct market research” may describe the project at a high level. It says considerably less about whether the agent will scrape an individual’s profile, combine it with another dataset, infer a characteristic and retain the result.
That is the mismatch.
European Regulators Have Not Conceded That Purpose Limitation Is Obsolete
There is an important counterargument.
The unpredictability of AI does not necessarily mean that GDPR concepts such as purpose limitation are legally unworkable.
The European Data Protection Board has taken essentially the opposite position.
In its Opinion 28/2024 concerning AI models, the EDPB said controllers should still identify specific processing purposes and explain how the expected functionality and deployment context of an AI model inform those purposes. The Board acknowledged that the final deployment purpose may not always be completely known during development, but it still expects controllers to provide meaningful specificity based on what is known at each stage.
That creates the real compliance challenge.
A company cannot simply say, “the agent decided to do it.”
The organization deploying the system still determines its permissions, objectives, available tools, accessible datasets and operating environment.
Agentic autonomy may make compliance harder, but regulators are unlikely to treat autonomy as an exemption.
Further Processing Gets More Complicated
Agents can also use information in ways that were not obvious when the information first entered the system.
The IAPP authors give the example of an agent with access to fitness information.
Step counts and activity records might initially be processed to provide basic fitness analytics.
But an advanced system could combine those records with sleep patterns, heart rate, calendar information and behavioral changes and infer something substantially more sensitive, such as burnout or a possible health condition.
The underlying data may not have changed.
The meaning extracted from it has.
This raises difficult questions around purpose compatibility, sensitive-data processing and transparency.
Traditional compliance processes often examine a new use of data before it begins.
A privacy team conducts an assessment. Legal evaluates the proposed purpose. Engineers implement controls.
An agent may generate the new use during execution.
A human privacy committee is not going to convene between tool calls.
The Personal Versus Nonpersonal Data Boundary Also Becomes Less Stable
The second major argument in the IAPP article concerns the distinction between personal and nonpersonal information.
Privacy laws generally become applicable because information relates, directly or indirectly, to an identifiable person.
That sounds straightforward until multiple datasets are combined.
A ZIP code might not identify someone.
A browsing event might not identify someone.
A device characteristic might not identify someone.
A purchase pattern might not identify someone.
Combine enough seemingly innocuous signals, however, and identification or detailed inference may become possible.
AI makes these combinations easier.
Agentic AI makes them dynamic.
An agent can seek additional context when existing information is insufficient, link records across systems and continuously update what it believes about an individual.
The IAPP authors describe this as an environment where the traditional distinction between personal and nonpersonal information begins to erode because contextual information gains value when combined inside AI systems.
Anonymization Becomes Harder When AI Is Good at Reconstructing Context
This issue also affects anonymization.
Removing a name from a dataset does not necessarily make the remaining information anonymous under European law.
The question is whether an individual remains identifiable using means reasonably likely to be used.
AI changes what is technically feasible.
Information that seemed difficult to reconnect with an individual several years ago may become easier to correlate as models improve and more outside data becomes available.
The EDPB has already warned against assuming an AI model is anonymous merely because direct identifiers are absent. Its AI-model opinion says anonymity must be evaluated case by case, including the likelihood that personal data could be extracted from a model or linked back to individuals.
Agentic systems add another layer because they can actively seek the missing information necessary to complete the connection.
Data Minimization Runs Into the Agent’s Hunger for Context
Many useful agents improve when they have more context.
Give a customer-service agent only an order number and it can answer questions about the order.
Give it the customer’s transaction history, emails, previous support tickets, product usage, preferences and loyalty status and it can potentially solve much more complicated problems.
From an engineering perspective, greater context can increase capability.
From a privacy perspective, the instinct is often the opposite.
Why does the system need access to all of that information?
This tension is likely to become one of the defining design questions for enterprise AI.
The answer cannot simply be to give every agent access to everything in case the information becomes useful.
That would collide directly with data minimization, access-control and security principles.
California Creates a Different Version of the Same Problem
The California Consumer Privacy Act does not mirror the GDPR’s architecture.
But California is also moving toward greater scrutiny of automated systems.
The California Privacy Protection Agency finalized regulations in 2025 covering automated decisionmaking technology, risk assessments and cybersecurity audits. The regulations became effective January 1, 2026, with certain ADMT requirements applying beginning January 1, 2027.
Where a covered business uses ADMT to make a significant decision involving areas such as employment, housing, education, financial services or healthcare, California’s framework provides notice, opt-out rights where applicable and a right to obtain meaningful information about how the technology functioned in relation to the consumer.
An agent can complicate those requirements for the same reason it complicates GDPR transparency.
If an autonomous system considered hundreds of intermediate signals, called several tools and changed its reasoning path as it worked, explaining what the system actually did may be considerably harder than explaining a conventional scoring algorithm.
The Real Privacy Problem May Be Permissioning
Much of the compliance debate around agentic AI focuses on models.
In enterprise deployments, permissions may ultimately matter just as much.
An agent that cannot access personal data cannot misuse personal data it never receives.
An agent that cannot send information to an outside service cannot accidentally disclose it there.
An agent that has read-only access cannot independently modify customer records.
This suggests that the privacy architecture for agents will need to focus heavily on:
- which systems an agent can access;
- which data fields it can retrieve;
- which external tools it can call;
- which actions require human approval;
- how long working memory is retained;
- whether sensitive data can leave a local environment;
- what the agent is prohibited from inferring or using; and
- how every action is logged.
The objective may be open-ended.
The operating environment does not have to be.
Privacy Controls May Have to Move From Policies Into Runtime
This is where the original article’s thesis becomes particularly useful.
Fenwick, Jurcys and Minssen argue that agentic AI may require a shift from static privacy policies toward active compliance controls operating while the AI is working.
That could mean an agent attempts to retrieve health information and a policy engine blocks the request.
It could mean access to a new database triggers a legal-basis check.
It could mean personal information is redacted before it reaches an external model.
It could mean the agent needs human approval before combining certain datasets.
It could mean purpose restrictions are translated into machine-readable rules rather than existing only inside a privacy notice.
It could mean data is deleted from temporary agent memory automatically after the task ends.
Compliance, in other words, becomes part of the execution environment.
The Audit Trail Becomes Critical
Autonomy also creates an accountability problem.
If an employee opens a customer record, organizations can typically log who accessed it.
If an agent performs 300 actions across 14 systems to accomplish one objective, the company needs a much richer record.
What objective was the agent given?
Which model was operating?
Which tools did it invoke?
What personal data did it retrieve?
What information did it infer?
Which external services received data?
Did a policy control intervene?
When did a human approve an action?
Without that evidence, meaningful accountability becomes difficult.
A company cannot demonstrate why processing occurred if it cannot reconstruct what its own agent did.
Privacy by Design May Become Literal Architecture
The IAPP authors also suggest a greater role for local processing and privacy-by-default architecture.
The idea is straightforward.
Instead of sending every piece of personal information into centralized external models, organizations could keep more sensitive data within controlled environments and allow agents to interact with it through carefully defined interfaces.
Some computation could occur on-device or at the edge. Sensitive records could remain locally stored. External agents might receive only the minimum information required to complete a particular operation.
That does not solve every legal problem.
It does reduce the number of places where personal information needs to travel.
Do We Need New Privacy Law?
This is where the debate becomes less certain.
One view is that agentic AI exposes fundamental flaws in existing privacy frameworks.
Consent cannot meaningfully describe unpredictable future processing.
Purpose limitation struggles when systems discover intermediate purposes autonomously.
Data minimization conflicts with systems whose performance often improves with broader context.
The personal/nonpersonal distinction weakens when AI can continuously combine signals and generate new inferences.
Under this view, agentic AI requires more than another set of regulatory guidelines. It may require rethinking some of the basic concepts underlying data protection law.
The opposing view is less dramatic.
Privacy law has always governed technologies that controllers do not understand perfectly.
The organization deploying the agent still decides why it is being deployed, what information it can access and what actions it is authorized to take.
The answer, on this view, is not abandoning purpose limitation or data minimization. It is designing agents so those principles can actually be enforced.
European regulators currently appear closer to the second position. The EDPB has continued applying existing GDPR principles to AI while acknowledging that applying them requires context-specific analysis.
The Mismatch Is Real Even If the Law Survives It
The most useful insight from the agentic AI debate may sit somewhere between those positions.
The GDPR is unlikely to disappear because software has become autonomous.
Neither is California likely to abandon transparency, opt-out and risk-assessment requirements because an agent’s workflow is complicated.
But companies may need to change what privacy compliance looks like technically.
The first generation of internet privacy was heavily document-driven.
Write a privacy policy.
Identify a legal basis.
Maintain a data inventory.
Conduct an impact assessment.
Agentic AI will make those controls insufficient on their own.
Organizations will need permissions, policy engines, audit logs, purpose-aware access controls, data minimization at runtime and mechanisms capable of stopping an agent while the processing is occurring.
That is where the original thesis becomes difficult to dismiss.
Agentic AI does not merely introduce another category of software for privacy teams to inventory.
It changes who — or what — determines the next processing operation.
Privacy law traditionally assumes the controller makes that decision before processing begins.
An autonomous agent may make thousands of those decisions after it starts.
The challenge for the next generation of privacy engineering is therefore not to make autonomous systems completely predictable.
Doing so could defeat much of their value.
It is to make unpredictable systems operate inside predictable boundaries.