GDPR and AI agents: who is responsible for what when AI reads your emails and invoices

In short

• Your company remains the controller of the data. Kendu Intelligence will be your processor, and the GDPR then requires a written contract between us (Article 28). The AI model provider will act as our own sub-processor, unless the model runs through your cloud account.
• Our common rules will limit each agent to minimal access, read-only when the software allows it. Each of its actions will be recorded in a log.
• Does someone ask by email for access to their data or its erasure? Our Emails and Support agent, in preparation, will not reply: it will stop and pass the request to someone on your team.

An AI agent that sorts your emails reads names, addresses, sometimes delicate subjects. An agent that handles your invoices sees your contacts' details and, in expense reports, your employees' data. The GDPR (General Data Protection Regulation) does not forbid these uses. It asks for clear roles, a contract and as little data as possible.

Controller, processor, sub-processor: who is who

• The controller is the one who “détermine les finalités et les moyens du traitement” (determines the purposes and means of the processing) (Article 4, point 7). The purposes are the “why”, the means the “how”. That is your company: you decide why the agent reads your emails (to sort them, to prepare a reply) and what it may do with them.
• The processor processes the data “pour le compte du responsable du traitement” (on behalf of the controller) (Article 4, point 8). That is us, when we install and supervise your agents.
• The sub-processor is the provider that the processor brings in in turn. The regulation speaks of an “autre sous-traitant” (another processor) (Article 28 §2 and §4). Here, it is notably the AI model provider, that is, the program that reads the text and drafts a proposal.

Note: a processor that set the purposes and means itself, in breach of the regulation, would be considered the controller of that processing (Article 28 §10).

Exception: the model can run through your own account with a cloud provider, that is, an online host such as Google Cloud or Amazon Web Services. That platform's terms then apply (Anthropic help), under your contract with it. Google Cloud and Amazon Web Services, for example, declare themselves processors of their customer (Google Cloud, Article 4.1; Amazon Web Services, Article 1.1). The exact split of roles between you, us and the platform depends on the set-up: to be checked with your adviser.

The processing contract (Article 28): what it must contain

You may only use a processor that offers “garanties suffisantes” (sufficient guarantees) (Article 28 §1). The written contract sets out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of people concerned (Article 28 §3). It also provides that the processor:

• processes the data only on your documented instructions, including for a transfer outside the European Union;
• guarantees the confidentiality of the people who have access to it;
• ensures the security of the data (Article 32);
• brings in another processor only with your written authorisation, and imposes the same obligations on it;
• helps you respond to people's requests about their data;
• helps you meet your obligations on security, data breach notification and impact assessment (Articles 32 to 36);
• deletes your data or returns it to you at the end of the service, as you choose, unless the law requires it to be kept;
• gives you what you need to check all this, audits included.

Your written authorisation of a sub-processor may be specific or general. If it is general, you are informed of any planned change and can object to it (Article 28 §2). The initial processor remains fully liable to you if its own processor fails to meet its obligations (Article 28 §4).

On the model side, take Anthropic, which supplies the Claude models. Its data processing addendum (version in force since 24 February 2025) is part of its commercial terms, those of the API and of the business offerings. Anthropic undertakes there to act as a processor of its customer (clause B.1). It gives notice before adding a sub-processor. The customer then has fifteen days to object, for a reasonable reason relating to data protection or security; with no objection, the change is deemed accepted (clause C.3). If the model runs through a third-party platform, that platform's terms apply (Anthropic help).

Minimise: each agent accesses only what it needs

The regulation asks for data “limitées à ce qui est nécessaire” (limited to what is necessary) (Article 5 §1 c). Our rules common to all agents put it into practice like this:

• The minimum rights for each connector. The connector is the small program that will link the agent to your email, your bank or your invoicing. Its access will be as narrow as possible, read-only when the software allows it. The Accounting Documents agent, for example, will read your bank transactions to match them with supporting documents; it will never pay.
• Nothing beyond the specification, the document you approve before anything is built: no personal data will go anywhere other than where it provides.
• No needless copies. The Emails and Support agent will not keep the content of messages outside the tracking record for each request.
• A log of every action. It will note what the agent read, what it suggested, who approved, when, and with which version of the agent.
• As little as possible on our side. When the agent runs on your side, only indicators and alerts will go up to our supervision tool, which is in preparation.

For example, an SME with 30 employees wants an agent that prepares its unpaid-invoice reminders. It needs the invoices, the due dates, the payments received and the contact to chase. It needs neither the accounting team's whole mailbox, nor its clients' bank details beyond matching payments to invoices.

Transfers outside the EU: the AI model question

To prepare a draft, the agent sends the model the text to read. Where does that model work? The GDPR governs any transfer of data to a country outside the European Union (Chapter V). Two routes are common:

• an adequacy decision: the European Commission finds that a country “assure un niveau de protection adéquat” (ensures an adequate level of protection) (Article 45);
• appropriate safeguards, for example standard data protection clauses, model contracts adopted by the Commission (Article 46).

Anthropic's addendum incorporates these standard clauses, to the extent the law requires (clause I.1).

Anthropic's direct API currently offers two settings for the place of computation: “global”, where computation may take place in any available zone, or “us”, in the United States only. The data Anthropic stores for your workspace is stored in the United States only. On Amazon Bedrock and Google Cloud, the computation region depends on the chosen endpoint (Anthropic documentation, accessed on 13 October 2026). That is why the place where your agents will run and the route the model will take are decided with you. The options are detailed on the Data and security page.

Record, impact assessment and individuals' rights: the agent stops and hands over

The record of processing activities is the written list of your uses of data. For each processing activity, it states in particular the purposes, the categories of people and data, the recipients, transfers outside the EU, erasure deadlines and security measures (Article 30 §1). We will draft these lines with you from the specification of each agent. The processor also keeps a record of the processing it carries out for its clients (Article 30 §2).

An exemption exists for organisations with fewer than 250 employees. It does not apply if the processing is not occasional, if it carries a risk for individuals or if it involves sensitive or criminal data (Article 30 §5). An agent that reads your emails every day can hardly pass as occasional: in case of doubt, keep the record.

This exemption could change. In June 2026, the negotiators of the European Parliament and the Council agreed on a new wording of Article 30 §5 (compromise text sent by the Council). The exemption would apply to organisations with fewer than 1,000 employees, except notably for processing likely to result in a high risk for individuals. As of 13 October 2026, this text has not been adopted: the Parliament's plenary vote is scheduled, as an indication, for 23 November 2026 (procedure file). Only the wording published in the Official Journal of the EU will count.

Another question to settle for each agent before it goes live: the impact assessment. It is a written study of the risks of the processing and the planned protections. It is compulsory “avant le traitement” (before the processing) when the processing is “susceptible d'engendrer un risque élevé pour les droits et libertés des personnes physiques” (likely to result in a high risk to the rights and freedoms of natural persons) (Article 35 §1). As a processor, we must help you carry it out (Article 28 §3 f).

Anyone can ask for access to their data, its correction or erasure, or object to its use (Articles 15, 16, 17 and 21). You must inform them of the action taken within one month. If necessary, this period may be extended by two months, “compte tenu de la complexité et du nombre de demandes” (taking into account the complexity and number of requests), provided you tell the person within the first month and explain why (Article 12 §3). Such a request may arrive by email. It is a stop case written in the rulebook of our Emails and Support agent, in preparation: it will not reply, it will flag the request and pass it to the person designated on your side. And in our method, a data deletion is always approved by a human before it is carried out, whatever the agent's level of autonomy.

Business contacts: legal basis and retention periods

The specification of the Quotes and Prospects agent will state the legal basis, that is, the reason that permits the processing, and the retention period for the contact details it handles.

• Legal basis. In France, according to the CNIL, legitimate interest (Article 6 §1 f) can justify email marketing to professionals, notably when the message relates to their profession. Condition: inform them and let them object simply and free of charge, from the point of collection and then in every message. After an objection, the data is no longer used for marketing (Article 21 §3).
• Rules by country. In Spain, a commercial email is forbidden if the recipient has not requested it or expressly authorised it beforehand (LSSI, Article 21), including when the recipient is a company (annex, point d). Exception: an existing client, whose contact details were lawfully obtained, for products or services similar to those they bought, with a simple and free way to object. In Belgium, sending without prior consent to a company is allowed if the address is impersonal, of the info@ type (royal decree of 4 April 2003, Article 1). According to the report to the King that accompanies this text, a named employee address is treated as that of an individual. The specification will therefore set the rule of the recipient's country.
• Periods for marketing (CNIL guidelines in France, not binding). For a prospect, three years from collection or from the last contact coming from them, for example a click on a link in an email. For a client, the length of the business relationship, then three years from its end. Departing from this remains possible, if justified.

This article does not replace the advice of your data protection officer or a lawyer.

Going further

• Data and security: where your agents run and who sees what.
• Our method: the specification you approve and the autonomy levels from 0 to 3.
• The audit: your tools and the personal data involved, listed before any agent. At €490 excl. VAT, deducted from the agents quote if you sign it within 30 days.