Agentic AI is an emerging form of artificial intelligence. Unlike traditional AI assistants that provide information or generate content, agentic AI systems can autonomously plan, make decisions, interact with other systems, and take actions on behalf of users. While these capabilities offer significant benefits for consumers and businesses, they also create new challenges for privacy, data protection, and accountability.
The Digital Regulation Cooperation Forum (DRCF), comprising the ICO, FCA, CMA and Ofcom, highlights in its March 2026 foresight paper, The Future of Agentic AI, that many of the privacy risks associated with AI remain relevant to agentic systems. The paper is a discussion document rather than a statement of regulatory policy. However, greater autonomy, multi-agent interactions, and access to external systems can amplify existing risks and introduce new complexities for organisations seeking to comply with data protection laws.
Why Agentic AI Raises Data Protection Concerns
Agentic AI systems are often designed to access information from multiple sources, coordinate with other agents, store information from previous interactions, and execute tasks with limited human intervention. As these systems become more capable, they may process significant amounts of personal data and make decisions that directly affect individuals. This creates challenges around transparency, accountability, lawful processing, and the protection of individual rights.
The DRCF emphasises that the development of agentic AI does not remove organisations' responsibilities under existing UK data protection legislation. Instead, organisations must ensure that the same principles, including fairness, transparency, accuracy, accountability, security, and data minimisation, continue to be applied throughout the lifecycle of these systems.
Key Data Protection and Privacy Risks
Excessive access to personal data: Agentic AI systems may be granted broad access to personal and operational data to improve performance. This can conflict with the data minimisation principle, which requires organisations to process only the personal data necessary for a specific purpose.
Unauthorised disclosure of information: Autonomous agents may inadvertently share confidential information, credentials, emails, or personal data with inappropriate recipients or third parties, creating privacy and security risks.
Lack of transparency in decision-making: Multi-agent systems can become difficult to understand and explain. Users and organisations may struggle to determine how a decision was reached, what data was used, or why information was shared.
Automated decision-making and profiling risks: Agentic AI may make or contribute to decisions that have legal or similarly significant effects on individuals, such as determining eligibility for credit or applying discounts. These activities may trigger additional data protection requirements under the UK GDPR's rules on solely automated decision-making and significant decisions, including specific safeguards and, where special-category data is involved, additional restrictions.
Challenges in accountability and controllership: As agents exchange data across interconnected systems, it may become more difficult to determine which organisation is responsible for processing personal data and who is accountable in the event of a compliance failure.
Difficulty exercising data protection rights: Consumers may find it harder to identify which organisation to contact to access their data, challenge decisions, correct inaccuracies, or exercise other rights under data protection law.
Data accuracy issues and cascading errors: Errors or hallucinations generated by one agent may propagate across connected systems, resulting in inaccurate personal data processing and potentially unfair outcomes for individuals.
Purpose limitation risks: Data collected for one purpose could potentially be reused or shared across agents and systems in ways that exceed the original processing purpose, creating compliance concerns.
Privacy vulnerabilities in interconnected systems: The sharing of personal data between multiple agents, tools, and external services may increase the likelihood of data leakage, unauthorised processing, or other privacy incidents.
Reduced visibility for users: Users may not fully understand what they have delegated to an agent or how their personal information is being collected, analysed, and shared as tasks are completed autonomously.
Mitigating the Risks
The DRCF paper discusses several measures that organisations may wish to consider when deploying agentic AI systems. These include applying the principle of data minimisation, implementing data protection by design and by default, maintaining traceable logs and records of decision-making, conducting Data Protection Impact Assessments (DPIAs) where there is a high risk to individuals, and ensuring meaningful human oversight where decisions may significantly affect individuals. Transparency regarding how personal data is collected, shared, and used is also essential to maintaining public trust.
In particular, organisations should take care to limit agent access to only the data necessary to complete assigned tasks, establish clear permissions and governance controls, and ensure they can explain how decisions have been made when individuals seek information about the processing of their data.
Conclusion
Agentic AI has the potential to transform how individuals and organisations interact with technology by automating increasingly complex tasks. However, its autonomy, ability to access multiple data sources, and interconnected nature create new privacy and data protection challenges. While many of these risks are extensions of those already associated with AI, the DRCF and the ICO note that agentic systems have the potential to exacerbate them. Organisations adopting agentic AI should therefore embed strong governance, transparency, and privacy safeguards from the outset to ensure innovation develops in a trustworthy and compliant manner.
How To Get In Contact
If you require assistance with any aspect of data protection and privacy law, or have questions about your legal obligations, please contact our Data Protection and Privacy team on 020 4600 9907 or email info@culbertellis.com.
Accurate at the time of writing. This information is provided for general information purposes only and should not be relied upon as legal advice.
.png)