GDPR and AI Agents: Who Is the Data Controller When a Bot Updates a Contact?
This article is general information, not legal advice. Talk to a data-protection professional about your specific situation.
When an AI agent updates a contact record, the same data-protection duties apply as when a person does it. But the agent may be hosted by a third party and acting on instructions nobody wrote down.
Roles do not change; accountability does
You remain the controller for your customer data. Your CRM provider is typically a processor for that data. The model provider is often a processor too, depending on its terms. What changes is that you need to show which agent acted, on whose instruction and why.
For AI PRO CRM specifically: as set out in our Privacy Notice, we act as a processor for the CRM data you put in your workspace and as a controller for your account data. AI PRO CRM does not run AI models; you bring your own agent and choose its provider.
Purpose limitation
Each agent should have a stated purpose, such as "summarise sales calls". In AI PRO CRM every agent has a name, a purpose, a business role label and a named owner who must be an active member of the workspace. Call records help you spot activity outside that purpose.
Data minimisation
Give each agent the least access that does the job. AI PRO CRM has no field-level or per-record agent permissions, so minimisation comes from whether an agent gets a credential, which preset it has (Analyst is read-only; Assistant can also add company notes) and how long the credential lasts. Also minimise what your agent sends to its model. The agent call ledger never stores arguments, results or note bodies.
Lawful basis and transparency
Nothing about agents changes your lawful basis for processing, but your privacy notice may need to mention automated tools. If an agent makes decisions with legal or similarly significant effects on individuals, extra rules on automated decision-making apply, including a person's right to human involvement. Design your process so a human can intervene.
Subject access and erasure
Requests must cover data that agents created or modified. In AI PRO CRM the only thing an agent can write is an internal note on an existing company, and each note is recorded with the agent as its author. Note that archiving a record in AI PRO CRM hides it but does not delete it. If you need help with an erasure request, contact us.
International transfers
If your agent's model runs outside the UK or EEA, personal data sent in prompts may be a restricted transfer. Minimise what goes into prompts, and document the transfer mechanism.
FAQ
Do I need a DPIA to use AI agents in my CRM?
Often advisable and sometimes required, particularly where agents profile individuals or process special category data. Records of each agent's owner, purpose and activity help.
Is the agent a "data subject"?
No. It is a tool. In AI PRO CRM its actions are recorded against the agent and credential it used.