AI agents and data protection: what the ICO is asking

The UK's data protection regulator, the Information Commissioner's Office (ICO), is asking organisations how they manage the data protection risks of AI agents. You do not have to respond to benefit from it. The headings it has chosen show where it expects an organisation to have an answer, which makes them a useful checklist for anyone planning an agent now.

What the ICO announced

On 8 October 2026 the ICO launched a six-week call for evidence on agentic AI, aimed at developers, deployers and other experts. Responses are due by 20 November 2026 through the consultation page. The announcement describes AI agents as systems that can complete tasks, use tools and interact with websites, often with limited human oversight.

The ICO says the evidence will inform its future guidance and support its forthcoming statutory code of practice on AI and automated decision-making. Its plans for new guidance list agentic AI guidance as being drafted, with a final version due in autumn 2026.

Richard Nevinson, the ICO's Director of Technology Regulation, said in the announcement that "the fact AI agents act with autonomy is not an excuse for poor compliance". We read that plainly: the organisation that deploys an agent remains responsible for what it does with personal data.

Why agents change the picture

A chatbot answers a question. An agent acts: it might read an inbox, look up a customer record, call another system and write the result somewhere. The ICO's Tech Futures report on agentic AI describes it as combining the capabilities of generative AI with additional tools and new ways of interacting with the world. The report lists the data protection risks that follow, including:

• Difficulty determining controller and processor responsibilities through the agentic AI supply chain.
• Purposes set too broadly, to allow for open-ended tasks and general-purpose agents.
• Processing personal information beyond what is necessary to achieve the instruction.
• Unintended use or inference of special category data.
• Added complexity that affects transparency and how easily people can exercise their information rights.
• New threats to cyber security.
• A larger amount of automated decision-making as more complex tasks are automated.

None of these is a new legal idea. They are familiar data protection principles meeting a system that chooses its own steps.

Six questions to answer before you build

The call for evidence is organised under six headings: data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness of processing. The questions below are our practical reading of each heading, not the ICO's wording.

• Data security: which systems and credentials can the agent reach, and what is the least access that still lets it do the job?
• Transparency: do the people whose information the agent handles know that it does, and could you explain what it did in a particular case?
• Accountability: for each supplier in the chain, such as the model provider and the hosting service, who is the controller and who is a processor, and is that written down?
• Automated decision-making: which of the agent's actions amount to a decision about a person, and where does someone review them?
• Fairness and purpose limitation: is the task defined narrowly enough that you can say which personal data it needs and which it does not?
• Lawfulness: what is your lawful basis for each kind of personal data the agent touches?

If any of these is hard to answer, that is worth knowing before the build starts.

Practical steps for a small team

Agents suit the approach in our post on scoping a first AI project: one workflow, with an owner, small enough to judge. On top of that, a few design choices make the six questions much easier to answer.

• Give the agent its own account with narrow permissions, not a member of staff's login.
• Start read-only. Add the ability to send, change or delete only where the workflow needs it, with a person approving those actions at first.
• Keep a log of what the agent read, which tools it called and what it changed.
• Write the purpose in one sentence, and remove the data fields the task does not need.
• Record which suppliers are involved and what each one receives.
• Decide who owns the agent after launch, and who is told when it does something unexpected.

These are ordinary engineering decisions. They cost little at the design stage and a great deal more to add once an agent is in daily use.

What to do now

If you already run or test agents, consider responding before 20 November. The ICO says it may not consider responses received after the deadline. If you are still planning, there is no reason to wait for the final guidance, because the principles behind the six headings already apply. This article is a summary, not legal advice.

If you are planning an agent or a document workflow and want its access and data handling designed in from the start, tell us about it. You can also read how we approach natural language processing and how Own Your Stack replaces costly SaaS subscriptions with custom software.