AI Agents and Data Protection: What the ICO Expects Now

An AI agent is a system that does not just answer: it plans, uses tools, logs in, sends, buys and changes things on your behalf. Vendors are selling them to every size of business this autumn. In the space of a month the regulators have said two things about them that a buyer should hear before signing: the UK’s Information Commissioner that autonomy “is not an excuse for poor compliance”, and Spain’s regulator that it has received the first notification of a personal data breach caused by an attack carried out by one.

What the ICO did on 8 October

The ICO announced that ten foundation model developers — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — had made changes after its engagement: clearer transparency information, stronger ways for people to exercise their rights, and tougher assessments of safeguards. It is monitoring their progress. The same announcement said the ICO has made enquiries of OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agent testing, following reports of agents that bypassed protections, used unauthorised communication channels and accessed external systems. Those enquiries are ongoing.

Alongside, the ICO opened a call for evidence on agentic AI, running to 20 November 2026, asking how organisations manage data protection risk across security, transparency, accountability, automated decision-making, fairness and lawfulness. The answers will shape its guidance. Richard Nevinson, the ICO’s Director of Technology Regulation, put the regulator’s position in one line: “the fact AI agents act with autonomy is not an excuse for poor compliance.”

What Spain’s regulator saw on 14 September

The Agencia Española de Protección de Datos (AEPD) reported the first breach notification it had received where the attack was executed by an AI agent built on a well-known language model. On the organisation’s account, the agent searched for weaknesses, achieved a successful login, then went on by itself to find vulnerabilities in the application, alter personal data and read invoices. The AEPD is careful: one case is not a trend, and the model’s provider was not compromised. Its point is that AI “does not create new threats” but “increases the speed, scale and adaptability” of known ones, and that a risk assessment which refers generically to malware or phishing is no longer enough. Its recommendations: name AI-executed attacks in your risk analysis; test whether your response times, written for human attackers, still hold; protect identities and credentials, above all accounts, API keys and tokens with more permissions than they need; and keep human oversight with automated detection and containment behind it.

What this means if you are deploying agents

• You are still the controller. An agent that reads your customer records or sends email on your instruction is your processing. The vendor is your processor, and the contract must say so under Article 28 — including what the agent may do with the data and where it goes.
• Credentials are the attack surface. The AEPD’s case turned on a login. Give agents their own identities, the least access that does the job, and keys you can revoke. An agent with a human’s password is a breach waiting for a date.
• Decisions need a human who can say no. If an agent approves refunds, screens applicants or suspends accounts, the automated decision-making rules apply — Article 22 in the EU and, since February, Articles 22A to 22D in the UK.
• Assess before you switch it on. New technology applied to personal data at scale is a classic data protection impact assessment trigger under Article 35, and accountability for what an agent does is one of the six themes the ICO’s call for evidence asks about.
• Log what it did. You will need the record for the breach notification you hope never to make, and for the person who asks why a decision was taken about them.

If you want to put the case for how agents should be regulated, the ICO’s call for evidence is open until 20 November. If you want to deploy one safely, our AI governance services cover the assessment, the contract and the controls.