The EDPB Is Asking About Your AI Agents. Most Teams Can't Answer.

On March 19, 2026, the European Data Protection Board launched its fifth Coordinated Enforcement Action — and 25 Data Protection Authorities across Europe started contacting organizations with a specific question about their data processing. The question sounds straightforward. For teams running AI agents, it exposes a gap that logs alone cannot close. The question: can you document what personal data you processed, in which sessions, on what legal basis, and with what protections in place? For a standard web application, this is answerable. For most AI agent deployments, it isn't — not because the data isn't there, but because agents don't have a bounded, predictable data footprint. An agent decides in real time which records to pull into its context window. That decision shifts with every session, every input, every tool call. And most teams have no session-level record of what the agent actually touched. GDPR transparency obligations — as codified in Articles 12, 13, and 14 — requir