GDPR
The General Data Protection Regulation (GDPR) is the European Union's data protection law, enforceable since May 2018. It governs how organizations collect, process, store, and transfer personal data of EU residents, with requirements around lawful basis, data minimization, purpose limitation, and individual rights.
Why It Matters
GDPR's relevance to AI agents is architectural. When an agent accesses a system that contains personal data (a CRM, an HR system, a customer database), every tool call that reads or processes that data is a data processing operation under GDPR.
For organizations routing agent traffic through a SaaS gateway, GDPR creates a sub-processor question: if the gateway handles personal data in transit, the gateway provider becomes a sub-processor, which triggers Data Processing Agreement (DPA) requirements. Self-hosting the gateway is the clean resolution for EU buyers who need to avoid this designation.
GDPR also requires data protection impact assessments (DPIAs) for high-risk processing. AI agents that autonomously access personal data at scale are likely to trigger DPIA requirements, making governance infrastructure a regulatory prerequisite rather than a security preference.