When 'agentic AI' meets data protection law: A fundamental mismatch?
Agentic AI systems — which act autonomously across tasks and tools — are creating friction with existing data protection frameworks designed around human-directed data processing. The core tension is whether laws built for discrete, controlled data use can govern AI that acts on its own initiative.
Why this matters: Data protection law was written with a person or a company making a deliberate choice to do something with your data. Agentic AI breaks that model. It acts, decides, and moves data on its own, sometimes across many systems in a single task. Nobody fully controls the chain. That makes the basic questions — who is the data controller, what is the legal basis, how do you honor a deletion request — much harder to answer. If the law cannot keep up, the protections people think they have may not apply in practice.
Who should care: General readers · AI governance · Policy · Privacy officers
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.